Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →To test an API for broken object-level authorization (BOLA), use authorized test accounts to request each other’s objects, then verify whether the API discloses data or permits an action the caller’s access policy forbids. Test the permission for the specific object and action—not just whether the caller is logged in or the identifier is hard to guess.
What BOLA is—and what it is not
OWASP describes object-level authorization as a code-level access-control mechanism that checks whether a user may access a particular object. BOLA occurs when a caller can use an API function but the API does not adequately check permission for the specific object named in the request. An object identifier may appear in a URL path, query string, header, or request body; sequential numbers, UUIDs, and other formats do not change the authorization requirement. See OWASP API1:2023 Broken Object Level Authorization.
As an Amazon Associate I earn from qualifying purchases.
The issue can affect reads, updates, partial updates, and deletes, as well as nested routes, GraphQL mutations, and batch operations that accept arrays of IDs. A read flaw may expose another person’s information; a write or delete flaw may change or destroy it. OWASP also notes that BOLA can have further consequences, including account takeover in some circumstances, but the outcome depends on what the affected objects and operations allow.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Repair Windows errors before they cause bigger problems3Fix the driver behind crashes, sound loss and screen glitchesKeep the authorization boundary precise. BOLA concerns access to the wrong object. Broken function-level authorization concerns use of a function or operation the caller should not be allowed to invoke at all. Broken object-property-level authorization concerns fields within an otherwise accessible object that the caller should not be able to read or change. OWASP’s 2023 API risk material places excessive data exposure and mass assignment under object-property-level authorization: OWASP Top 10 API Security Risks – 2023.
#1 Best Overall
Set up a controlled cross-account test
Run tests only on systems for which you have authorization, using designated test accounts and data. Before sending requests, write down the intended access rules: which users, roles, and tenants may perform each action on each kind of object. This gives you a policy to test against rather than relying on assumptions about ownership.
- Inventory operations that act on objects. Review API documentation and client traffic. Look for object references in paths, query parameters, headers, JSON or form bodies, GraphQL variables, and arrays of IDs. Include list responses and nested routes, such as a user’s orders. OWASP’s Web Security Testing Guide for API BOLA and REST Assessment Cheat Sheet describe these testing concerns.
- Prepare equivalent objects for separate principals. Use two authorized accounts or tenants. Create or select the same type of object under each, and record which account owns or may access each object and which actions the policy permits.
- Capture each account’s normal request. As account A, make a permitted request for A’s object; then repeat as account B for B’s object. Preserve the method, route, request body, relevant headers, and authenticated session context so the requests can be compared.
- Swap only the object reference. Replay A’s request under A’s authenticated session, substituting B’s object identifier. Then test the reverse direction. Where possible, use an identifier the other session can already observe—for example, one exposed in a list or notification—rather than relying only on guessing. This helps test authorization independently of identifier discovery.
- Repeat for each relevant action and request shape. Check reads, updates, partial updates, and deletes where the API supports them. Include nested routes, GraphQL operations, and batch requests. A protected read does not establish that a corresponding write route is protected.
- Verify the outcome and record evidence. Check returned data and, for writes or deletes, the object’s state. Record the principal, object, action, expected policy, observed response, and any confirmed effect.
- Retest after a fix. Add regression cases for each affected action and object relationship. OWASP recommends tests that evaluate the authorization mechanism and advises against deploying changes that cause those tests to fail.
How to interpret a response
The key question is whether the authenticated caller accessed or acted on an object outside the application’s intended permission policy. A response that contains another user’s protected data, or a verified unauthorized state change, is strong evidence. An HTTP status alone is weaker: an API may mask whether an object exists, return a generic response, or use a nonstandard error convention. Compare the observed result with the expected policy and inspect side effects.
Rank #2
Check for legitimate access before labeling a result BOLA. The test may be authorized if the accounts share an object, belong to the same tenant, or have an administrative grant. Likewise, unpredictable IDs do not prove that authorization is working: OWASP recommends random identifiers as a defense in depth, not as a replacement for permission checks.
Prioritize coverage by object, action, and caller
A useful test plan crosses the relationships and request forms that can change the authorization decision. OWASP’s guidance emphasizes the object, the requested action, and the endpoint or operation through which it is reached. For each case, compare the caller’s policy relationship to the object with the operation being attempted.
Rank #3
- Object relationship: owner, another user’s object, same-tenant object, different-tenant object, delegated access, or an object available through a role.
- Action: read, update, partial update, delete, or another operation supported by the API.
- Request shape: single identifier, nested route, GraphQL variable, or batch list.
- Caller: account, role, or tenant whose permissions are being evaluated.
Do not assume one successful denial covers every route or action. For example, an ownership check on a detail endpoint may not be applied to a batch export or a nested update route.
Report BOLA separately from adjacent authorization flaws
| Finding | Authorization question | Typical evidence |
|---|---|---|
| BOLA (object-level) | May this caller perform this action on this particular object? | The caller reaches another user’s object by supplying its identifier and obtains data or causes an unauthorized change. |
| Broken function-level authorization | May this caller invoke this function or operation at all? | The caller can access an operation reserved for a different role, such as an administrative function. |
| Broken object-property-level authorization | May this caller read or change these fields on an otherwise accessible object? | The caller receives or modifies properties that should be restricted. |
A single route can have more than one authorization flaw. Describe whether each finding crosses an object, function, or property boundary rather than grouping every access-control issue under BOLA.
Rank #4
- API Security in Action
- Manning Publications
- ABIS BOOK
What to change in the API
Enforce authorization using the application’s policy model whenever a code path retrieves or changes a record based on client input. Evaluate the caller’s permission for the requested action on that particular object. An equality check between a session user ID and one request parameter is not a general solution: ownership, delegated access, tenant membership, and role grants can make valid access rules more complex.
Free tools Windows power users keep installed
One-click scans. No signup required.
Apply the checks consistently across routes and request shapes, follow least privilege, and use regression tests that fail if the authorization boundary is lost. Random, unpredictable identifiers can make enumeration more difficult, but they remain supplementary to authorization checks.
Best Value
Tools can help replay requests, but do not replace the policy test
OWASP’s Web Security Testing Guide names ZAP, Burp Suite, Postman, and fuzzing tools as aids for sending requests, changing object references, and observing responses. The REST Assessment Cheat Sheet also describes request swapping and manual comparison. Choose a tool based on the API protocol and test workflow: the essential check is still whether the authenticated principal may perform the requested action on the specific object.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
