BOLA, BFLA & BOPLA: The API Authorization Testing Checklist

The quick-reference authorization checklist Broken authorization is the number one bug class in APIs, and it has three faces. This is the scannable checklist I run through when I’m testing an API for it — definitions, setup, and copy-paste test steps for each. For the full exploitation depth (every bypass primitive, parser quirks, real CVEs) see the API Security guide; this page is the field checklist that sits next to it. Authorization bugs don’t show up in a scanner because nothing is malformed — every request is well-formed and authenticated. The flaw is that the server never checked whether this caller should touch that thing. You find them by comparing what one identity can do against what another identity should be able to do, which means the whole game is two accounts and a disciplined replay. BOLA vs BFLA vs BOPLA What it is OWASP API One-line test BOLA Access an object you don’t own by changing its ID API1:2023 Swap the ID/token; can you read or write someone else’s object?…