Slide 17 of 28
Part 3 · Attack ScenariosSlide 17
Slide 17 · The Pattern
Nine scenarios. One root cause.
Every single attack exploited the same gap.
The Pattern

E-commerce. Healthcare. Banking. Fitness. Dating. Delivery. Documents. Smart homes. HR systems.

Nine completely different industries. Nine completely different types of data. One identical failure.

The API checked authentication — "Are you logged in?" — but skipped authorization — "Are you allowed to access this specific object?"

What the API asked
Is there a valid token? ✓
Is the user logged in? ✓
Does this endpoint exist? ✓
What the API never asked
Does this user own object #1041?
Is this user allowed to see this record?
Does this token match the requested data?
Authentication vs Authorization — the two-second version

Authentication = proving who you are. A valid login, a valid token. "Yes, I know you."

Authorization = proving what you're allowed to do. "Yes, I know you — and this specific record belongs to you."

BOLA is always, always, always an authorization failure. The API knew who the user was. It just never asked if the user was allowed to have what they asked for.

← Back Now — how do we stop it? →