API1:2023 — Broken Object Level Authorization

Slide 7 · BOLA vs BFLA

There's a similar one. Here's the difference.

BOLA and BFLA are cousins — easy to confuse, important to keep separate.

BOLA · API1

Broken Object Level Authorization

You access the wrong object

Same role, different user's data

Example: You're user 1042. You see user 1041's order.

Both users are regular customers — you just got their stuff

BFLA · API5

Broken Function Level Authorization

You access the wrong function

Lower role accesses higher-privilege actions

Example: You're a regular user. You call the admin endpoint.

You shouldn't have that power at all — it's a role violation

The easy way to remember it

BOLA = accessing someone else's stuff (wrong object, same level)

BFLA = accessing actions you shouldn't have (wrong function, wrong level)

BOLA is about what you can see. BFLA is about what you can do.

Why it matters

BOLA is API1 — the most common. BFLA is API5. Both are authorization failures. This module covers BOLA. You'll see BFLA in a later module.