Hi,
First of all, thank you for creating and maintaining this excellent project. As a Security Auditor, I have studied the entire OWASP API Security Top 10 and have assessed numerous real-world applications through both Bug Bounty programs and penetration tests.
I would like to suggest an addition to the Broken Object Level Authorization (BOLA) prevention guidance.
The current recommendations mention using GUIDs/UUIDs or other randomly generated identifiers instead of predictable object IDs. While this is certainly a good practice, I believe it is important to emphasize that unguessable identifiers are not a substitute for authorization checks.
In my experience, developers sometimes assume that once an endpoint uses GUIDs or other high-entropy identifiers, additional authorization validation becomes less important. This assumption can create a dangerous false sense of security.
For example:
- Endpoint A performs a sensitive action, such as deleting a file, and identifies the target object using a GUID.
- The endpoint fails to verify whether the authenticated user actually owns or is authorized to access that object.
- Endpoint B, perhaps due to another vulnerability or an overly permissive API response, exposes the GUIDs of objects belonging to other users.
Once an attacker discovers those GUIDs through Endpoint B, the identifiers are no longer secret. Since Endpoint A relies on the GUID instead of enforcing proper authorization, the attacker can perform unauthorized actions, such as deleting arbitrary users' files.
This demonstrates that replacing sequential IDs with GUIDs reduces the risk of enumeration but does not prevent BOLA. Every request that accesses or modifies an object should still perform a server-side authorization check to verify that the authenticated user is permitted to access that specific object.
I believe adding a note or example like this would help reinforce an important security principle and prevent developers from relying on GUIDs as an authorization mechanism. I hope this suggestion is helpful and contributes to making the guidance even stronger.
Hi,
First of all, thank you for creating and maintaining this excellent project. As a Security Auditor, I have studied the entire OWASP API Security Top 10 and have assessed numerous real-world applications through both Bug Bounty programs and penetration tests.
I would like to suggest an addition to the Broken Object Level Authorization (BOLA) prevention guidance.
The current recommendations mention using GUIDs/UUIDs or other randomly generated identifiers instead of predictable object IDs. While this is certainly a good practice, I believe it is important to emphasize that unguessable identifiers are not a substitute for authorization checks.
In my experience, developers sometimes assume that once an endpoint uses GUIDs or other high-entropy identifiers, additional authorization validation becomes less important. This assumption can create a dangerous false sense of security.
For example:
Once an attacker discovers those GUIDs through Endpoint B, the identifiers are no longer secret. Since Endpoint A relies on the GUID instead of enforcing proper authorization, the attacker can perform unauthorized actions, such as deleting arbitrary users' files.
This demonstrates that replacing sequential IDs with GUIDs reduces the risk of enumeration but does not prevent BOLA. Every request that accesses or modifies an object should still perform a server-side authorization check to verify that the authenticated user is permitted to access that specific object.
I believe adding a note or example like this would help reinforce an important security principle and prevent developers from relying on GUIDs as an authorization mechanism. I hope this suggestion is helpful and contributes to making the guidance even stronger.