API3:2023 — Broken Object Property Level Authorization

Slide 4 · API3 vs. API1

Not the wrong object. The wrong fields.

API1 and API3 look similar but break at different levels.

API1 — Broken Object Level Auth

Wrong object entirely

You access someone else's user object

You change the ID in the request

GET /users/1042 → you own user 1041

Fix: check ownership before returning any data

API3 — Broken Object Property Level Auth

Wrong fields of your own object

You access properties within your user object you shouldn't see or change

You add extra fields to the request body

PUT /users/1041 + body: {"isAdmin": true}

Fix: check property-level permissions, not just object access

They can combine

A single API endpoint can fail both. BOLA lets you reach the wrong user's object. BOPLA lets you read or set sensitive fields within any object you can reach. An attacker who chains both can reach any user's object and modify their role, balance, or status.

← Back Why does this keep happening? →