Chapter 2 of 7 · 4 practices · 4 min · 4-question quiz
Object-level authorization: stop IDOR and BOLA
Checking that a user may call an endpoint is not enough. Each object they ask for, by ID, has to belong to something they may access.
Start: Scope every lookup to what the caller may access4 practices in this chapter
- 1Scope every lookup to what the caller may accessAn insecure direct object reference (IDOR), called broken object level authorization (BOLA) in the OWASP API Security Top 10, is when
GET /invoices/1043returns invoice 1043 to anyone who asks. It… - 2Return the same response for missing and forbidden objectsIf
/invoices/1043returns 403 and/invoices/9999returns 404, an attacker learns which invoice IDs exist, and from that, often how many customers you have and how fast you grow. OWASP's IDOR… - 3Authorize fields too: what can be read and what can be writtenObject-level checks can still leak through individual properties. ASVS 5.0 requirement 8.2.3 covers field-level access, which the API Security Top 10 calls broken object property level authorization…
- 4Protect the indirect paths: files, search, exports and nested objectsThe main CRUD endpoints usually get checked. The leaks come from side doors: Files and object storage. OWASP's cheat sheet says static resources and cloud buckets need access control matched to the…
Check yourself on this chapter
4 questions, right here once you are signed in. Your progress is saved as you read.