API3:2023 — Broken Object Property Level Authorization

✅

Module Complete

You finished API3 — Broken Object Property Level Authorization. Here's what you now understand:

✓What BOPLA is — authorization failures at the field level, not the object level

✓Two sub-risks: Excessive Data Exposure (API returns too much) and Mass Assignment (API accepts too much)

✓How it differs from API1 — API1 is the wrong object; API3 is the wrong fields of the right object

✓Real incidents — GitHub 2012 (mass assignment via Rails auto-binding, admin access in one request) and Peloton 2021 (private fields returned in API response for 4M+ users)

✓OWASP scenarios — dating app location leak, marketplace price manipulation, social media moderation bypass

✓Seven mitigations: allowlists, disabling auto-binding, DTOs, server-side-only properties, minimizing responses, schema validation, and enforcing at the API layer

The one thing to carry forward

Every property in your data model needs two questions answered: "Who is allowed to read this?" and "Who is allowed to set this?" If neither question has a deliberate answer, the default is "everyone" — and that's almost never what you intended.

← Back to Quiz Next: API4 — Unrestricted Resource Consumption →