Web Security · Senior · Question 65 of 75

What is BOLA in the OWASP API Security Top 10?

✓Correct answer: Broken object level authorization: the API doesn't check that the caller owns the object identified in the request
2Blocking of legitimate APIs by firewalls
3Bad output length allocation in buffers

Explanation

It's the API name for IDOR and has been the top API risk. Authorization checks belong in every handler or a shared policy layer.

Further reading

Test yourself

Take the Web Security · Senior quiz: questions and options are shuffled, and you get a review of your mistakes at the end.