1. In API security, what does BOLA (Broken Object Level Authorization) usually look like?
Difficulty: EasyType: MCQTopic: API Security
B O L A happens when the server does not check ownership for each object access. If the endpoint trusts a user supplied ID without verifying that the caller owns that object, attackers can simply swap the ID and access other users’ records. The fix is simple in idea but hard in practice: enforce server side authorization on every object access. Do not rely on hidden fields or client logic.
Example code
GET /api/orders/123 // attacker swaps to /api/orders/124 // Server must check: does caller own order 124?