thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Application & OT Security · Foundational

Broken Object Level Authorization (BOLA)

API1:2023, failure to verify that the caller is authorized to access the specific object identified in a request.

Definition

APIs expose object IDs in paths and bodies; if the server checks only authentication, not ownership, attackers can enumerate IDs to access others' data. It is the API equivalent of IDOR. Mitigation: per-object authorization checks using the authenticated identity, plus unpredictable IDs as defense in depth.

Example

GET /api/v1/orders/58213 returns another customer's order because only the token's validity is checked.

Exam tip

BOLA equals IDOR in API terms; random GUIDs help but are not a fix by themselves.

Related terms