Broken Object Level Authorization (BOLA / IDOR)

Broken Object Level Authorization (BOLA / IDOR)

Overview

BOLA (also called IDOR — Insecure Direct Object Reference) is the #1 API vulnerability. It occurs when an API endpoint uses a user-supplied ID (from URL, query parameter, or request body) to access an object without verifying that the current user is authorized to access that specific object.

Example: GET /api/v1/users/{userId}/orders — if userId from the path is trusted without checking that the authenticated user matches userId, any user can access any other user's orders.

Detection Strategy

• Route handlers that use URL path parameters (:id, :userId) to query the database directly without an ownership check
• No comparison between the authenticated user's ID and the requested resource's owner ID
• Use of findById() or getById() without a tenant/user scope filter

Remediation

Always scope database queries to the authenticated user's context.

Vulnerable (Express.js):

app.get('/api/orders/:orderId', auth, async (req, res) => {
    const order = await Order.findById(req.params.orderId); // No ownership check!
    res.json(order);
});

Safe:

app.get('/api/orders/:orderId', auth, async (req, res) => {
    const order = await Order.findOne({ _id: req.params.orderId, userId: req.user.id });
    if (!order) return res.status(404).json({ error: 'Not found' });
    res.json(order);
});