BOLA, the #1 API Vulnerability: a One-Line Fix and an A-B Test in Go and PHP
An invoicing application exposes an API : web addresses, or URLs, that other programs call to read or change invoices. Bob is logged in with his account. He asks for his invoice at the URL GET /invoices/7f3b , where GET means "read". The API answers with his invoice and the response code 200, which means "OK". Bob changes one character in the URL and asks for GET /invoices/7f3a . The API answers…
An invoicing application exposes an API with URLs for reading or modifying invoices. Bob, logged in, requests his invoice at GET /invoices/7f3b, receiving a 200 OK response. Changing the URL to GET /invoices/7f3a, the API again returns 200, but the invoice now belongs to Alice. This is called BOLA (Broken Object Level Authorization), where authorization is broken for each object, such as an invoice.
OWASP has ranked this as the top API vulnerability in 2023. The fix is a single line of code that checks if the invoice belongs to the logged-in user. A test can also validate the fix by replaying the scenario. The vulnerability lies in the API fetching the invoice based on the identifier without checking the user's ownership. Identifiers should be unique and difficult to guess, and additional checks should be implemented to prevent unauthorized access.
A test for the vulnerability requires two accounts: one to create the invoice and another to attempt accessing it, expecting a 404 Not Found response.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
