Check the object, not just the route
Explain why every API endpoint that accepts an object identifier needs an object-level authorization check.
The reframe: object IDs are not evidence of permission. Route permission is too coarse An API route like GET /orders/{id} may be valid for customers, support agents, and admins. That does not mean every customer can read every order. Route-level authorization answers whether the caller can use the function. Object-level authorization answers whether the caller can use the function on this specific record. The dangerous moment is the lookup BOLA usually appears where code converts a client-controlled identifier into a database object. If the lookup is find(id), the server has accepted the client's boundary. If the lookup is constrained by…
Sign up free — one personalized lesson every day, matched to your role and goals.
Already have an account? Sign in