Intermediate LevelREST APIs & Web Services
What are the OWASP API Security Top 10 vulnerabilities (BOLA, BFLA, Mass Assignment)?
❓ Interview Prompt: Explain OWASP API Top 10 vulnerabilities: BOLA (Broken Object Level Authorization), BFLA (Broken Function Level Authorization), Mass Assignment, and Unrestricted Resource Consumption.
The OWASP API Security Top 10 lists critical security risks in modern Web APIs:
1
API1: BOLA (Broken Object Level Authorization): #1 threat! User 10 changes URI to '/api/users/11' and accesses User 11's data because server checks if user is logged in, but fails to check resource ownership!
2
API2: Broken Authentication: Weak token validation or credential stuffing.
3
API3: Broken Object Property Level Authorization (Mass Assignment): Attacker sends '{ "isAdmin": true }' in JSON update body and server binds it directly to database model!
4
API4: Unrestricted Resource Consumption: Missing rate limits or memory bounds.
Code Implementation Example
typescript
// BOLA Security Vulnerability & Fix:
app.get('/api/v1/orders/:orderId', async (req, res) => {
const order = await db.order.findUnique({ where: { id: req.params.orderId } });
// ❌ BOLA Bug: Missing ownership check!
// res.json(order);
// ✅ FIX: Verify logged-in user OWNS the requested order object!
if (order.userId !== req.user.id) {
return res.status(403).json({ error: 'Access Denied' });
}
res.json(order);
});💡Fixing Broken Object Level Authorization (BOLA) by enforcing resource ownership checks.
🎯 Interview Key Takeaway
Enforce strict resource ownership checks on every API endpoint to prevent Broken Object Level Authorization (BOLA).
#OWASP API Top 10#BOLA#Security#Intermediate
Back to all REST APIs & Web Services Questions→