Slide 8 of 28
Part 1 · What Is It?Slide 8
Slide 8 · Why APIs Are Different
APIs made this problem much worse.
The shift to APIs moved a responsibility — and most teams didn't notice.
Before APIs — the server was in control

Old web apps rendered HTML on the server. You clicked "My Account." The server looked up your session, grabbed your data, and returned a page built just for you. You never touched an ID. The server handled everything. If the server was coded correctly, you only ever saw your data.

After APIs — the client is in control

Modern apps use APIs. Your phone, your browser, your third-party integration — they all send requests with IDs. GET /api/users/8831/profile. The client picks the ID. The server just responds. Now the server has to actively verify every ID it receives — and most of the time, it doesn't.

The numbers don't help

Most APIs use sequential integer IDs — 1, 2, 3, 4. If your ID is 1042, order 1041 and 1043 almost certainly exist. An attacker doesn't need to guess. They just count. The data is practically labeled.

The bottom line

APIs are everywhere now. Every mobile app, every SaaS product, every connected device runs on APIs. BOLA is so common because the architecture that powers the modern internet creates this problem by default — and fixing it requires every developer to remember to add a check they weren't taught to add.

← Back Let's go deeper → How does it actually work? →