api-authorization-and-bola

A focused testing playbook for API authorization flaws, centered on Broken Object Level Authorization (BOLA) and its neighbors: Broken Function Level Authorization (BFLA), HTTP method abuse, and mass assignment of hidden fields. Load it when an API exposes object identifiers, nested resources, role-sensitive functions, or potentially writable fields that the client should not control.

The core test loop is simple and repeatable: create two accounts (A and B), capture Account A's create, read, update, and delete flows, replay those requests with Account B's token, and probe sibling endpoints, nested endpoints, and alternate HTTP verbs. It enumerates concrete test surfaces, including direct object reads like /api/v1/orders/123, nested objects like /api/v1/users/1/invoices/9, admin or internal functions like /api/v1/admin/users, PUT/PATCH/DELETE update variants, and hidden JSON fields such as role, org, verified, and tier, along with quick mass-assignment payloads like {"role":"admin"} and {"isAdmin":true}.

A 'what testers miss' section highlights easy-to-overlook cases: object IDs hidden in headers, cookies, or GraphQL arguments; alternate methods that share a route but enforce weaker authorization; a parent resource that is checked while its child is not; and admin documentation that reveals extra writable fields. For deeper follow-up it routes to companion skills, including API auth and JWT abuse for token-layer attacks, GraphQL and hidden-parameter discovery, and broader IDOR patterns outside APIs. It is best used during an API security assessment to systematically prove whether one user can access or modify another user's objects and functions.