API Design · Middle · Question 31 of 75

What does OWASP API1:2023 Broken Object Level Authorization describe?

1Weak passwords
✓Correct answer: An API that accepts an object ID from the client but doesn't check that the user may access that object
3Missing HTTPS

Explanation

Changing /accounts/123 to /accounts/124 should never reveal someone else's account. Check ownership in every handler.

Further reading

Test yourself

Take the API Design · Middle quiz: questions and options are shuffled, and you get a review of your mistakes at the end.