Broken Authorization

Authentication proves who you are. Authorization decides what you are allowed to do.

Broken authorization means the system lets users do or see things they should not.

BOLA stands for Broken Object Level Authorization.

It is the top API risk: an API checks that you are logged in, but not that the specific object you ask for actually belongs to you.

Imagine your account is user 100.

If you change the ID and the server still responds, you just read someone else's orders. That is BOLA.

Developers often trust the ID in the request.

They forget to verify the logged-in user actually owns that object. The fix is an ownership check on every request.

Another flaw is BFLA: Broken Function Level Authorization.

A normal user calls an admin-only action and it works, because the endpoint never checks the user's role.

Consider an admin route:

If a regular user can call it successfully, the API failed to enforce role-based access.

Some APIs blindly map request fields onto a record.

A user could add a field like role=admin to a profile update and quietly escalate their own privileges.

Never rely on the client to hide buttons or fields.

The server must enforce every authorization decision, because attackers send requests directly, bypassing your UI entirely.

Sequential IDs make BOLA easy to exploit.

Using random identifiers like a UUID does not replace authorization checks, but it removes the simple guess-the-next-number attack.

A safe API denies by default.

Access is allowed only when an explicit rule grants it. This way, a forgotten check fails closed rather than leaking data.

Authorization bugs hide easily, so test them on purpose.

Try accessing another user's data with your own token. If it works, you have found a serious flaw to fix.

An API confirms you are logged in but returns another user's record when you change the ID. What flaw is this?

Broken authorization lets users access what they should not. Watch for BOLA, BFLA, and mass assignment.

Enforce ownership and role checks on the server, deny by default, and test authorization deliberately.