BOLA Lab — Allow vs Deny

Demonstrate peer allow/deny on 127.0.0.1:8815 with toy users.

BOLA Lab — Allow vs Deny• Audio Walkthrough

00:00/02:04

Visual · api_bola_lab

Lab: two users, two objects, one token policy. Original Cyberlium.

Evidence is two status codes and a sentence.

Create or use toy users on YOUR lab. Prove allow on own object and deny on peer object.

1. Setup toy users

Use lab tokens userA/userB.

No real customer data.

Command guide

Try these commands — Setup toy users

═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)

BOLA testing — https://owasp.org/API-Security/editions/2023/en/0xa1-broken-object-level-authorization/ Postman auth — https://learning.postman.com/docs/sending-requests/authorization/

═══ INSTALL ═══

Linux (Debian/Ubuntu):

Command — copy this

sudo apt install curl
sudo apt install jq

macOS:

Command — copy this

brew install jq

Windows: Built-in (PowerShell: Invoke-WebRequest)

Command — copy this

choco install jq

═══ LINUX / macOS ═══

Command — copy this

for id in 1001 1002 1003; do curl -sS -o /dev/null -w "order $id as userA: %{http_code}
" -H "Authorization: Bearer userA" "http://127.0.0.1:8815/orders/$id"; done
curl -sS -H "Authorization: Bearer userA" http://127.0.0.1:8815/orders/1001 | jq .

Primary tools to practice this lesson: curl, jq. Reference sites: BOLA testing (https://owasp.org/API-Security/editions/2023/en/0xa1-broken-object-level-authorization/); Postman auth (https://learning.postman.com/docs/sending-requests/authorization/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.