diff --git a/routes/basket.ts b/routes/basket.ts
index c916bb584f9..5c42c59d83b 100644
--- a/routes/basket.ts
+++ b/routes/basket.ts
@@ -6,22 +6,18 @@
 import { type Request, type Response, type NextFunction } from 'express'
 import { ProductModel } from '../models/product'
 import { BasketModel } from '../models/basket'
-import * as challengeUtils from '../lib/challengeUtils'
-
 import * as utils from '../lib/utils'
 import * as security from '../lib/insecurity'
-import { challenges } from '../data/datacache'
 
 export function retrieveBasket () {
   return async (req: Request, res: Response, next: NextFunction) => {
     try {
       const id = req.params.id
+      const user = security.authenticatedUsers.from(req)
+      if (!user?.bid || user.bid !== parseInt(id, 10)) {
+        return res.status(403).json({ error: 'Access denied' })
+      }
       const basket = await BasketModel.findOne({ where: { id }, include: [{ model: ProductModel, paranoid: false, as: 'Products' }] })
-      /* jshint eqeqeq:false */
-      challengeUtils.solveIf(challenges.basketAccessChallenge, () => {
-        const user = security.authenticatedUsers.from(req)
-        return user && id && id !== 'undefined' && id !== 'null' && id !== 'NaN' && user.bid && user?.bid != parseInt(id, 10) // eslint-disable-line eqeqeq
-      })
       if (((basket?.Products) != null) && basket.Products.length > 0) {
         for (let i = 0; i < basket.Products.length; i++) {
           basket.Products[i].name = req.__(basket.Products[i].name)