What API1:2023 Broken Object Level Authorization requires
OWASP API Security Top 10 (2023) API1:2023 Broken Object Level Authorization. Object level authorization is an access control mechanism that is usually implemented at the code level to validate that a user can only access the objects that they should have permissions to access. Every API endpoint that receives an ID of an object, and performs any action on the object, should implement object-level authorization checks. The checks should validate that the logged-in user has permissions to perform the requested action on the requested object. Failures in this mechanism typically lead to unauthorized information disclosure, modification, or destruction of all data. Comparing the user ID of the current session (e.g. by extracting it from the JWT token) with the vulnerable ID parameter isn't a sufficient solution to solve Broken Object Level Authorization (BOLA). This approach could address only a small subset of cases. In the case of BOLA, it's by design that the user will have access to the vulnerable API endpoint/function. The violation happens at the object level, by manipulating the ID. If an attacker manages to access an API endpoint/function they should not have access to - this is a case of [Broken Function Level Authorization][5] (BFLA) rather than BOLA. This category sits within the OWASP API Security Top 10 (2023 edition), the canonical industry list of the ten most critical API security risks. Organizations implementing API services should treat each of the ten categories as both a design constraint and a continuous-monitoring obligation, with policies, automated testing, and incident response procedures defined per category.
Pillar: Cybersecurity · Authority: OWASP Foundation (Open Worldwide Application Security Project) · Version: 1.0.0 · Last updated:
Primary source: https://owasp.org/API-Security/editions/2023/en/0xa1-broken-object-level-authorization/
SHA-256 integrity: 9b175a34aa0ffe08aea4e6736b2d30b3cd48e7b42394ea54790faa7f4071f07e
Primary Citations — 11 traced to source
- OWASP API Security Top 10 (2023), API01:2023 Broken Object Level Authorization, How To Prevent: 'Implement a proper authorization mechanism that relies on the user policies and hierarchy.'
- OWASP API Security Top 10 (2023), API01:2023 Broken Object Level Authorization, How To Prevent: 'Use the authorization mechanism to check if the logged-in user has access to perform the requested action on the record in every function that uses an input from the client to access a record in the database.'
+ 9 more citations (full bibliography, deterministic workflow, actionable schema and crosswalks) included in the vault unlock — $0.01 via Skyfire / L402 / Direct Base USDC.
Access
- Discovery (free): /api/v1/nodes/owasp-api-top-10-2023-api01-broken-object-level-authorization.json — 6-field metadata
- Vault (full node): /api/v1/vault/nodes/owasp-api-top-10-2023-api01-broken-object-level-authorization.json — full 13-key payload, $0.01 USDC (L402/Skyfire/Direct Base)
- Canonical URL: https://bidda.com/intelligence/owasp-api-top-10-2023-api01-broken-object-level-authorization
- Back to registry: Browse all 10,090 compliance nodes