API1:2023 — Broken Object Level Authorization

Slide 10 · Horizontal BOLA

Same level. Different person's data.

Step by step — here's exactly what happens.

Step by step

Step 1. You sign up for a service. You become user 1042. Your orders live at /api/orders?userId=1042

Step 2. You open your browser's developer tools (F12 → Network tab). You see the exact API request your app is making.

Step 3. You change 1042 to 1041 and resend the request.

Step 4. The API returns user 1041's order — their name, address, items, payment method type. You're in.

// Your legitimate request GET /api/orders?userId=1042 → Returns: your orders ✓ // You change one number GET /api/orders?userId=1041 → Returns: someone else's orders ✗ // The API never asked: "Does user 1042 own these orders?"

What the API should have done

When it received userId=1041, it should have cross-referenced your session token: "The token says you're user 1042. You asked for user 1041's data. Denied." Instead it just fetched whatever ID it was given.

← Back Show me a real example →