8000 Create 02-API_Broken_Object_Level_Authorization.md by irgoncalves · Pull Request #1190 · OWASP/wstg · GitHub
[go: up one dir, main page]
More Web Proxy on the site http://driver.im/
Skip to content

Create 02-API_Broken_Object_Level_Authorization.md #1190

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Merged
merged 18 commits into from
Mar 29, 2025
Merged

Create 02-API_Broken_Object_Level_Authorization.md #1190

merged 18 commits into from
Mar 29, 2025

Conversation

irgoncalves
Copy link
Contributor
@irgoncalves irgoncalves commented Mar 16, 2025 •
edited by kingthorin
Loading

Add API BOLA Testing

This PR is part of issue #5.

What did this PR accomplish?

  • Add Broken Object Object Authorization - BOLA testing for the Testing Guide

@kingthorin
Copy link
Collaborator

Thanks, will try to review this week.

Hit me up if you haven't heard by Friday morning 😉

kingthorin
kingthorin reviewed Mar 24, 2025
View reviewed changes
10000
...plication_Security_Testing/12-API_Testing/02-API_Broken_Object_Level_Authorization_(BOLA).md Outdated
Comment on lines 75 to 85
## Remediations

To prevent BOLA, implement the following mitigations:

**Object Ownership Checks**: Ensure that object-level authorization checks are performed for every API request. Always verify that the user making the request is authorized to access the requested object.

**Role-Based Access Control (RBAC)**: Implement RBAC policies that define which roles can access or modify specific objects.

**Least Privilege Principle**: Apply the principle of least privilege to ensure that users can only access the minimum set of objects they need for their role.

**Use UUIDs or Non-Sequential IDs**: Prefer non-predictable, non-sequential object identifiers (e.g., **UUIDs** instead of simple integers) to make enumeration and brute-force attacks harder.
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Have a look at the template and make sure the heading matches. Use bullets :)

@kingthorin kingthorin changed the title Create 02-API_Broken_Object_Level_Authorization_(BOLA).md Create 02-API_Broken_Object_Level_Authorization.md Mar 28, 2025
@github-actions GitHub Actions

This comment was marked as resolved.

Sign in to view
@kingthorin
Copy link
Collaborator

@irgoncalves could you apply these changes/additions? I'm unable to for some reason:

diff --git a/document/4-Web_Application_Security_Testing/12-API_Testing/README.md b/document/4-Web_Application_Security_Testing/12-API_Testing/README.md
--- document/4-Web_Application_Security_Testing/12-API_Testing/README.md
+++ document/4-Web_Application_Security_Testing/12-API_Testing/README.md
@@ -3,5 +3,7 @@
 4.12.0 [API Testing Overview](00-API_Testing_Overview.md)
 
 4.12.1 [API Reconnaissance](01-API_Reconnaissance.md)
 
+4.12.2 [API Reconnaissance](02-API_Broken_Object_Level_Authorization)
+
 4.12.99 [Testing GraphQL](99-Testing_GraphQL.md)
diff --git a/document/README.md b/document/README.md
--- document/README.md
+++ document/README.md
@@ -313,8 +313,10 @@
 #### 4.12.0 [API Testing Overview](4-Web_Application_Security_Testing/12-API_Testing/00-API_Testing_Overview.md)
 
 #### 4.12.1 [API Reconnaissance](4-Web_Application_Security_Testing/12-API_Testing/01-API_Reconnaissance.md)
 
+#### 4.12.2 [API Reconnaissance](4-Web_Application_Security_Testing/12-API_Testing/02-API_Broken_Object_Level_Authorization)
+
 #### 4.12.99 [Testing GraphQL](4-Web_Application_Security_Testing/12-API_Testing/99-Testing_GraphQL.md)
 
 ## 5. [Reporting](5-Reporting/README.md)

@kingthorin
Copy link
Collaborator

Thank you!!

@kingthorin kingthorin merged commit c1414ba into OWASP:master Mar 29, 2025
3 checks passed
@kingthorin
Copy link
Collaborator

Don’t forget to fire in a PR adding yourself to the credits in section 1.

@irgoncalves irgoncalves deleted the new-5 branch April 1, 2025 11:40
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@kingthorin kingthorin kingthorin approved these changes

Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
2 participants
@irgoncalves @kingthorin
0