Yes. A batch API request still needs an authorization decision for every resource in it. Authentication establishes who made the call; it does not establish that the caller may read or change every submitted object. A permit for one item must never authorize the rest of the batch.
Why authentication does not authorize every object
Authentication answers “Who is calling?” Object-level authorization answers “May this subject perform this action on this resource in this context?” An authenticated user can still submit another user’s object ID or target an object belonging to a different tenant. OWASP cautions that comparing a session user ID with a submitted object ID is not a sufficient general fix for broken object-level authorization (BOLA). OWASP’s IDOR Prevention Cheat Sheet describes the underlying risk.
Batching changes how requests are transported and processed; it does not change the access policy. Check each requested object against the caller, intended action, and relevant trusted context. Keep endpoint-level permission separate: a caller may be allowed to invoke an endpoint but not to access a particular object. Apply field-level restrictions separately when individual properties have their own access rules.
How to authorize each item in a batch
- Build each decision from trusted context. Use the authenticated subject, intended action, target resource, tenant, and other policy-relevant context available to the server. Do not trust a client’s claim about its role or permissions.
- Evaluate every requested item. Use individual checks or a batch decision interface that returns a distinct result for each item. A batch response is not a single authorization decision.
- Match results to inputs reliably. Associate each decision with its input using validated item identifiers or the positional ordering defined by the API contract. Do not assume ordering unless that contract guarantees it.
- Release or mutate only validly permitted items. Treat a missing, malformed, unexpected, or error result as a denial for the affected item. Reject duplicate or misassociated decisions according to the contract; uncertain results must not grant access.
- Recheck when circumstances can change. If authorization may change between the decision and a later read or mutation, check again at the enforcement point for that operation.
OWASP’s Authorization Cheat Sheet puts the core batch rule plainly: “Do not apply one item’s permit to the entire batch.”
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →#1 Best Overall
Choosing an approach for collections
The right implementation depends on the size of the candidate set, the policy, and the datastore integration. A collection shortcut is safe only if it preserves the same subject, action, resource, and context rules as checking each item.
| Approach | When it fits | What to verify |
|---|---|---|
| Bounded per-item checks | A small, bounded set of candidate objects. | Every candidate receives its own decision; only permitted items are returned or changed. |
| Authorized-resource-ID query | A larger collection where policy can produce the IDs the subject may access. | The result is complete, and any pagination, cap, or failure is visible to the application. An incomplete ID set cannot justify weakening restrictions. |
| Policy-aware query filter | The policy can be represented in a datastore query or documented filtering integration. | The filter preserves the intended policy for the subject, action, resource, and context, rather than approximating it. |
These options are not interchangeable by label alone. Compare policy fidelity, candidate-set size and cost, completeness, failure behavior, exposure through outputs, and whether later state changes require a fresh decision. For large or paginated collections, the application must know whether the authorized results are complete before treating them as a basis for access.
Protect indirect outputs and nested routes
Authorization must cover every path by which protected information or effects can escape, not only a direct object read. Lists, search results, exports, counts, and aggregates can reveal information about objects a caller cannot access. Apply the same policy to nested routes: checking access to a parent does not automatically establish access to every child, and checking a child alone may not satisfy a parent-level rule.
Also keep function-level checks distinct from object-level checks. Permission to call an export or delete endpoint does not, by itself, authorize every row or object included in that operation. Where returned objects contain fields with different access rules, enforce field-level restrictions as well.
Define the batch response contract
Document whether a batch is atomic or allows partial success, how per-item denials appear in the response, and whether the API conceals the existence of denied resources. OWASP requires enforcing each item’s authorization result but does not prescribe one universal all-or-nothing response policy. Whatever policy the endpoint adopts, denied object data and unauthorized side effects must not become observable.
Make failure behavior explicit too: a decision-service error, missing result, or invalid result must not become an implicit permit. The contract should explain whether that condition denies the item or causes the whole operation to abort, and the implementation should behave consistently with that contract.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Test across identities, actions, and result failures
Use two controlled accounts or tenants with objects of the same type. Capture valid requests for each identity, then substitute identifiers across identities. Test read and write operations—such as GET, PUT, PATCH, and DELETE where applicable—and nested paths where only a parent may have been checked. Also compare ordinary-user access with owner-only and administrator-only operations so object-level failures are not confused with function-level restrictions.
For batch behavior, test all-permitted and all-denied inputs, as well as mixed-authority batches. Exercise missing, malformed, duplicate, and misordered decision results, along with a downstream authorization-service error. Confirm that no denied item’s data or side effect escapes and that the observed response follows the documented atomicity, partial-success, and concealment rules. OWASP’s API Security guidance on broken object-level authorization is a useful basis for cross-identity object-access tests.
Quick Recap
Best Value
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
