Advanced Cybersecurity & Threat Landscape
API Security: BOLA and Mass Assignment
Broken object level authorization lets a user swap an ID and read or modify another tenant's data, and mass assignment lets a client set fields the developer never intended to expose. Both are OWASP API Top 10 staples and both are trivial to exploit once found. They persist because authorization checks live in the wrong layer or never get written at all.
Головне
- Enforce authorization checks on every object access using the authenticated user's identity, not the client-supplied ID.
- Use allowlists for accepted input fields; never bind request bodies directly to internal models.
- Return only the fields the caller needs; avoid generic serializers that leak internal columns.
- Add rate limiting and anomaly detection on endpoints that accept object IDs.
- Test authorization with automated suites that try cross-tenant access for every endpoint.
- Log object access with user and tenant context so abuse is visible after the fact.
- Validate ownership server-side even when the client already knows the object ID.
- Review new endpoints in code review specifically for authorization and field exposure.
Часті запитання
What is BOLA in plain terms?
It is when changing an ID in a request gives you someone else's data because the server never checked ownership.
How is mass assignment different?
Mass assignment is about writing fields you should not control, like role or balance, by sending extra JSON keys.
Can a WAF stop these?
No. Both require the application to enforce authorization and input allowlists; a WAF cannot know your data model.
Where should authorization live?
At the service or handler layer, consistently, with tests that exercise the boundary rather than trusting the router.
Допомога Kinetikatech: advanced cybersecurity & threat landscape
Ми бралися за це сотні разів: The threats that bypass yesterday's controls: zero-days, AI-polymorphic malware, supply chain compromise, and cloud-native attack paths, with the defenses that actually hold. Служба Тести на проникнення та Безпека серверів Linux дає замкнений цикл: ми оцінюємо, впроваджуємо, цілодобово стежимо й підхоплюємо за 30 хвилин, коли це критично.