Understanding Broken Object Level Authorization: The Quiet Access Control Failure Undermining Today’s Apps

The #1 API Security Threat You Can’t Afford to Ignore

Broken Object Level Authorization (BOLA) is ranked as the #1 API security risk in the 2023 OWASP API Security Top 10 list. As systems have shifted to internet-exposed APIs, attackers can probe object IDs and harvest data they were never meant to have access to.

From Volkswagen’s connected-car API exposing owner data to T-Mobile’s unauthenticated endpoint leaking
37 million customer records, BOLA has been at the center of some of the most damaging incidents in recent memory.

In this webinar, you will learn about:

• Why object-level authorization is fundamentally different from role-based access control—and why confusing the two leads to catastrophic blind spots
• How attackers discover and exploit insecure direct object references using nothing more than predictable identifiers and unauthenticated endpoints
• How to enforce server-side authorization checks consistently across your APIs and gateways