API1:2023 — Broken Object Level Authorization

✅

Module Complete

You finished API1 — Broken Object Level Authorization. Here's what you now understand:

✓What BOLA is — the API checks who you are but not what you're allowed to access

✓Why APIs made this problem worse — clients now control what gets requested by ID

✓The difference between horizontal BOLA (same level, other user's data) and vertical BOLA (lower role, higher-privilege data)

✓Real breaches — Peloton (4M users), T-Mobile (37M customers), Bumble, USPS — and how they happened

✓7 mitigations: ownership checks, UUIDs, token-based identity, cross-user testing, DB-level filtering, centralized authorization, and monitoring

✓Authentication ≠ Authorization — knowing who someone is doesn't mean they're allowed to access everything they ask for

The one thing to carry forward

Every API endpoint that accepts an ID from a client must ask: "Does the person making this request own — or have permission for — this specific object?" If that question isn't asked on every request, every endpoint, every time — BOLA is waiting to happen.

← Back to Quiz Next: API2 — Broken Authentication →