Web Security & OWASP (50 Qs)•Part 2: OWASP Top 10 & Critical Vulnerability Deep-Dives (11 - 25)
Broken Object Level Authorization (BOLA / IDOR): Why it is the #1 API vulnerability and how to prevent it.
Understanding BOLA (Insecure Direct Object Reference)
BOLA occurs when an API endpoint uses an identifier (such as a database ID or account number) to access a resource, but fails to validate whether the authenticated user actually owns or has permission to access that specific object.
sql
Attacker (User ID: 105) sends request:
GET /api/v1/invoices/9842 HTTP/1.1
Authorization: Bearer <valid_jwt_for_user_105>
VULNERABLE BACKEND CODE:
SELECT * FROM invoices WHERE id = 9842;
-- Result: Returns sensitive invoice belonging to User 820! Complete privacy breach!
SECURE TENANCY-AWARE BACKEND CODE:
SELECT * FROM invoices WHERE id = 9842 AND user_id = 105;
-- Result: Returns 404 Not Found or 403 Forbidden!
Systematic Mitigation Blueprint
- Never rely on client-supplied IDs alone: Always scope database queries to the current authenticated user's session context:
typescript
// NestJS / Express Controller with Tenancy Guard
async getInvoice(@Param('id') invoiceId: string, @CurrentUser() user: UserSession) {
const invoice = await this.invoiceRepo.findOne({
where: {
id: invoiceId,
organizationId: user.organizationId // SCOPED TO TENANT!
}
});
if (!invoice) {
throw new NotFoundException('Invoice not found');
}
return invoice;
}
- Use Non-Sequential Identifiers (UUIDv4 / CUID):
Sequential numeric IDs (
1, 2, 3) allow automated scrapers to enumerate every customer in seconds. UUIDv4 (550e8400-e29b-41d4-a716-446655440000) prevents enumeration, though authorization checks are still strictly mandatory.