Glossary term
What is BOLA (Broken Object Level Authorization)?
BOLA stands for Broken Object Level Authorization.
In Backend in Depth
OWASP's name for IDOR in APIs. The endpoint checks who the caller is, but not whether the caller may use that specific object.
Learn it properly · Backend in DepthLesson 6: Authentication and Authorization on the ServerPassword hashing, session stores, checking JWTs properly, role-based vs attribute-based access control, and checking ownership on every resource.In Security for Developers
Getting another user's data by changing an object ID because the server never checked ownership; API1 in the OWASP API Top 10.
Learn it properly · Security for DevelopersLesson 7: APIs and Servers: SSRF, File Uploads, Rate Limits and MisconfigurationServer-side request forgery, unsafe file uploads, missing rate limits, verbose errors, CORS mistakes and the OWASP API Top 10, each with a small example and a fix.In API Design
An API returns an object by id without checking that the caller may access it.
Learn it properly · API DesignLesson 6: API Authentication and Authorization: API Keys, OAuth 2.0 and ScopesAPI keys, bearer tokens, OAuth 2.0 flows in plain words, scopes, and common mistakes. Ties back to the Security series.