Broken Object-Level Authorization (BOLA): Still #1

Modern APIs have hundreds of endpoints. Authorization is usually implemented as middleware that checks the authenticated user, sometimes as decorators that check role. Object-level checks ("is this user authorized for this specific object?") are usually implemented inline in the handler — and inline checks are the kind that get missed when developers are busy.

We do not test endpoints. We test object types. For each object type the application exposes (user, order, invoice, file, comment, ...), we enumerate every endpoint that reads or modifies it. Then we authenticate as two users in separate tenants and verify that user A cannot reach user B's objects through any of those endpoints.

For object type: invoice
Endpoints:
  GET    /api/invoices/:id        — read one
  PATCH  /api/invoices/:id        — modify
  DELETE /api/invoices/:id        — delete
  GET    /api/invoices/:id/items  — sub-resource
  POST   /api/invoices/:id/pay    — action
  GET    /api/exports/invoice/:id — async
For each: authenticate as user A, request user B's invoice ID, expect 403.

Async exports, batch endpoints, webhook callbacks, file downloads via signed URLs that ignore the original session, search endpoints that return objects without re-authz, GraphQL nested resolvers. All are common findings.

The fix is structural: centralize authorization, treat the authenticated user as a mandatory parameter to every query. See API security testing.