BOLA
Broken object level authorization
Broken object level authorization, OWASP API1:2023. An API accepts an object identifier without checking that the caller may perform the requested action on that object.
- Identifiers
- API1:2023 Broken Object Level Authorization
Covered in
Enforce authorization for every object action
Authorize the authenticated subject, requested operation, and specific resource together; a valid login or unpredictable identifier is insufficient.
Authorization models: RBAC, ABAC, ReBAC and policy as code you can test
Translate roles, attributes and relationships into explicit subject-action-resource decisions, prevent broken object level authorization (BOLA), and verify ownership and tenant boundaries with tests.
Worked threat model: a mobile banking app
A complete worked threat model for a mobile banking-style app: the data-flow diagram and its elements, STRIDE threats on the client, the transport and the backend, and the mitigations mapped to OWASP MASVS v2 controls and current Android and iOS platform APIs.
Review tenant boundaries before implementation
Trace tenant identity through requests, data stores, caches, jobs, and administration, then turn plausible isolation failures into tests.
Review trust boundaries in mobile and native clients
Protect local data and platform interactions while keeping server-side authorization independent of the client’s behavior.
Review a code change through its trust boundaries
Turn a pull request into a small set of security claims that can be checked against the surrounding system and tests.
All 8 pages that cover BOLA in the library
Practice: IDOR lab: Repair an invoice authorization bug · Local project: Secure a real HTTP API · Local project: Keep an iOS app's storage, links and web bridge in bounds · Local project: Repair an Android app's links, components, network policy and storage