🔑 BOLA/IDOR Attack Flow
Broken Object Level Authorization - OWASP API Security #1
flowchart TD
A[👤 Attacker - User ID: 456] -->|1. Authenticate normally| B[🔐 Login Success]
B -->|2. Receive valid token| C[🎫 JWT/Session Token]
C -->|3. Access own resource| D[📱 GET /api/users/456/profile]
D -->|4. Successful response| E[✅ Own Data Retrieved]
E -->|5. Modify resource ID| F[📱 GET /api/users/123/profile]
F -->|6. No authorization check| G[❌ Missing Access Control]
G -->|7. Database query| H[(💾 Database)]
H -->|8. Return victim's data| I[🎯 Victim ID: 123 Data]
I -->|9. Data leaked| A
style A fill:#ff6b6b,stroke:#f59e0b,stroke-width:2px,color:#fff
style B fill:#74c0fc,stroke:#f59e0b,stroke-width:2px,color:#000
style C fill:#ffd43b,stroke:#f59e0b,stroke-width:2px,color:#000
style D fill:#74c0fc,stroke:#f59e0b,stroke-width:2px,color:#000
style E fill:#f59e0b,stroke:#00cc33,stroke-width:2px,color:#000
style F fill:#ff6b6b,stroke:#f59e0b,stroke-width:2px,color:#fff
style G fill:#ff6b6b,stroke:#f59e0b,stroke-width:2px,color:#fff
style H fill:#a855f7,stroke:#f59e0b,stroke-width:2px,color:#fff
style I fill:#ff6b6b,stroke:#f59e0b,stroke-width:2px,color:#fff
J[🔒 Defense:
Object-Level Auth] -.->|Verify ownership| F
K[🛡️ Defense:
Indirect References] -.->|Use UUIDs| D
L[⚙️ Defense:
Policy Enforcement] -.->|Check every request| G
style J fill:#f59e0b,stroke:#00cc33,stroke-width:2px,color:#000
style K fill:#f59e0b,stroke:#00cc33,stroke-width:2px,color:#000
style L fill:#f59e0b,stroke:#00cc33,stroke-width:2px,color:#000
📋 Attack Flow Breakdown
1
Normal Authentication: Attacker authenticates as a legitimate user.
POST /api/auth/login {username: "attacker", password: "pass123"}
2
Enumerate Resource IDs: Discover predictable object identifiers.
GET /api/orders/1001, /api/orders/1002, /api/orders/1003
3
Test Authorization: Attempt to access other users' resources.
GET /api/users/123/documents (Not attacker's ID)
4
Exploit Missing Checks: Access granted despite not owning the resource.
200 OK - Returns victim's sensitive data
5
Automated Enumeration: Script to harvest all user data.
for id in range(1, 10000): fetch(f"/api/users/{id}/data")
6
Data Exfiltration: Mass harvesting of personal information, financial data, documents.
🛡️ Defense Mechanisms
✅ Implement Object-Level Authorization:
Verify that the authenticated user owns or has permission to access the requested object.
if (order.userId !== authenticatedUser.id) return 403;
✅ Use Unpredictable Identifiers:
Replace sequential IDs with UUIDs or random tokens.
/api/orders/a3f7e9c2-4d8b-11ed-bdc3-0242ac120002
✅ Implement Access Control Lists (ACL):
Maintain explicit mappings of user permissions to resources.
ACL: {user: 456, resource: order_1001, permissions: ['read']}
✅ Enforce at Data Layer:
Include user context in database queries.
SELECT * FROM orders WHERE id=? AND user_id=?
✅ Rate Limiting:
Detect and prevent mass enumeration attempts.
Limit: 100 requests per user per minute
✅ Log & Monitor:
Alert on suspicious access patterns (sequential ID access, 403 errors).