Glossary term
What is IDOR / BOLA? Meaning for developers
IDOR / BOLA stands for Insecure Direct Object Reference / Broken Object-Level Authorization.
Accessing other users' objects by changing an ID. Example: /invoices/1002 shows someone else's invoice.
Learn it properly · System DesignLesson 49: Authentication vs Authorization: Sessions, Cookies & JWTEvery endpoint checked “is the user logged in?” — and changing one number in the URL showed another customer's invoice. Authentication vs authorization, storing passwords, MFA and passkeys, sessions vs JWTs (with a live token to tamper with), and RBAC, ABAC and ReBAC.