API Security: Why BOLA Remains the #1 Risk
Broken object level authorization, BOLA, has topped the OWASP API Security list for years, and it is still the flaw we find most often. It is not clever or obscure. It is an API that checks who you are but not whether you are allowed to touch the specific thing you asked for. Here is how it works, how to test for it, and how to stop it.
What BOLA looks like
Imagine an endpoint that returns an invoice by ID:
http
GET /api/invoices/1043 HTTP/1.1
Authorization: Bearer <valid token for user A>The API confirms user A's token is valid and returns invoice 1043. But what happens when user A asks for invoice 1044, which belongs to user B? If the answer is that they get it, you have BOLA. The API authenticated the user but never checked that the object belonged to them.
How to test for it
Testing is straightforward and you can do it on your own staging environment: authenticate as one user, then try to read and modify objects that belong to another. The tell is when an ID you should not own returns real data instead of a 403.
bash
# As user A's token, walk a range of IDs and flag anything that is not denied
for id in $(seq 1040 1050); do
code=$(curl -s -o /dev/null -w '%{http_code}' -H "Authorization: Bearer $TOKEN_A" https://staging.example.com/api/invoices/$id)
echo "invoice $id -> $code" # 200 on someone else's invoice = BOLA
doneCheck every method, not just reads. An API that hides an object from GET but lets you PUT or DELETE it by ID is just as broken. Watch for UUIDs too, they are harder to guess but guessability is not the fix; authorization is.
The fix is boring and reliable: enforce an ownership check on the server for every object access, on every method. Do not rely on unguessable IDs, on the client hiding a button, or on the object not appearing in a list. Tie the check to the authenticated identity, every time.
Why it keeps happening
BOLA survives because authentication feels like authorization but is not, and because the check has to be repeated for every endpoint and every object. Miss it in one place and that one endpoint leaks. Automated scanners rarely catch it because they do not understand which object should belong to whom, which is exactly why manual testing matters here.
Want your APIs tested for BOLA and the rest of the OWASP API Top 10 by someone who checks by hand? That is part of our web application and API penetration testing, request a quote.
