API Design · Senior · Question 28 of 75
What's the difference between OWASP API1 (BOLA) and API5 (Broken Function Level Authorization)?
- 1API5 is about missing HTTPS
- 2They're the same
- ✓Correct answer: BOLA is accessing other users' objects; BFLA is calling functions you shouldn't, like admin endpoints, as a regular user
Explanation
Both need server-side checks: per object (ownership) and per operation (role or permission).