BOLA Named

Broken Object Level Authorization — after login, still check the object. Lab :8815.

BOLA Named• Audio Walkthrough

00:00/02:35

Visual · api_bola_named

BOLA is authz on objects. Original Cyberlium.

Logged in is not the same as allowed on this row.

BOLA (OWASP API1 family) is when the API authenticates you but fails to check ownership/tenant on the object ID. Practice the idea on YOUR lab — never ID-swap against stranger tenants.

1. Definition

User A authenticates. User A requests /orders/1002 belonging to B. Server returns B's data → BOLA.

Finding language: missing object-level authorization. Fix: deny by default; enforce ownership server-side.

Command guide

Try these commands — Definition

═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)

OWASP API1 BOLA — https://owasp.org/API-Security/editions/2023/en/0xa1-broken-object-level-authorization/ Authorization cheat sheet — https://cheatsheetseries.owasp.org/cheatsheets/Authorization_Cheat_Sheet.html

═══ INSTALL ═══

Linux (Debian/Ubuntu):

Command — copy this

sudo apt install curl

macOS: Built-in

Windows: Built-in (PowerShell: Invoke-WebRequest)

═══ LINUX / macOS ═══

Command — copy this

curl -sS -H "Authorization: Bearer userA" http://127.0.0.1:8815/orders/1001
curl -sS -o /dev/null -w "cross-user order %{http_code}
" -H "Authorization: Bearer userA" http://127.0.0.1:8815/orders/1002

Primary tools to practice this lesson: curl. Reference sites: OWASP API1 BOLA (https://owasp.org/API-Security/editions/2023/en/0xa1-broken-object-level-authorization/); Authorization cheat sheet (https://cheatsheetseries.owasp.org/cheatsheets/Authorization_Cheat_Sheet.html). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.