From the course: The OWASP API Security Top 10: An Overview

Unlock the full course today

Join today to access over 24,000 courses taught by industry experts.

API1:2019 broken object level authorization

API1:2019 broken object level authorization

From the course: The OWASP API Security Top 10: An Overview

Start my 1-month free trial Buy for my team

API1:2019 broken object level authorization

“

- [Instructor] So number one on the OWASP API security top 10 is broken object level authorization. So OWASP explains that broken object level authorization occurs because quote, APIs tend to expose endpoints that handle object identifiers creating a wide attack surface level access control issue. Object level authorization checks should be considered in every function that accesses a data source using input from the user. Okay, I know that sounds like a lot, but don't worry. We're going to make sure we break it down here. So first broken object level authorization, or bola is also known as insecure direct object references, or IDOR which is a vulnerability that's found in web applications. Bola or IDORs are access control vulnerabilities that occur when user supplied input is used to access other resources that they should not have access to regularly. For example, a user substitutes their user ID or token with one belonging…

Contents