NestJS · Middle · Question 31 of 75

Why check object ownership in addition to authentication?

1Authentication already prevents this
✓Correct answer: Otherwise an authenticated user can access other users' data by changing an ID (BOLA/IDOR)
3Only for admin routes

Explanation

Broken Object Level Authorization is the top item in the OWASP API Security Top 10.

Further reading

Test yourself

Take the NestJS · Middle quiz: questions and options are shuffled, and you get a review of your mistakes at the end.