IMPLEMENTASI LOGIC-BASED ROW-LEVEL SECURITY DAN ROLE-BASED ACCESS CONTROL PADA REST API MENGGUNAKAN GOLANG DENGAN PENDEKATAN GRAY-BOX TESTING

Abstract

Human Resource Information System (HRIS) APIs process highly sensitive financial data, making them prime targets for Broken Object Level Authorization (BOLA) and Insecure Direct Object Reference (IDOR) attacks. Relying solely on perimeter defenses is insufficient to protect data at the object level. This study proposes and evaluates a Defense in Depth (DiD) architecture on a Golang-based REST API, specifically targeting the financial endpoint /payroll/{id}. The implemented security layers encompass JSON Web Token (JWT) signature validation and Role-Based Access Control (RBAC) as the first layer, Logic-Based Row-Level Security (RLS) integrated with GORM for object-level access isolation as the second layer, and AES-256-GCM encryption for Data at Rest protection as the final layer. To eliminate developer bias, the system evaluation adopted a GrayBox Testing approach utilizing a documented blind testing protocol via automated Burp Suite Intruder. The blind testing results demonstrated that without RLS, a lowprivileged employee successfully extracted unauthorized payroll records (HTTP 200 OK). Following the RLS implementation, the system strictly denied unauthorized access attempts (HTTP 403 Forbidden). The system also detected and rejected direct manipulation of the encrypted ciphertext (HTTP 500), confirming the integrity of the AES-256-GCM authentication tag. The integration of these layers effectively mitigated the targeted vulnerabilities, reducing the Common Vulnerability Scoring System (CVSS) v4.0 base scores from a maximum of 9.3 (Critical) and 7.1 (High) down to 0.0 (None) across all tested scenarios. This research provides a resilient, measurable security framework for modern HRIS architectures.