testing-api-for-broken-object-level-authorization

To test an API for BOLA and IDOR vulnerabilities, replay authenticated requests while systematically substituting legitimate object identifiers with victim IDs to evaluate if authorization is properly enforced based on response status and data integrity.

Finding Broken Object Level Authorization in GraphQL APIs involves validating object access through node and relay patterns, testing relationship traversal with attacker tokens, and swapping authenticated requests across victim object IDs to detect exposure.

Yes, you can automate horizontal access control testing by using the included Python script workflow alongside Burp Autorize guidance to speed up authorization replay, triage results, and generate JSON reports of suspected BOLA read/write behaviors.

Checking for object ID enumeration during API security testing requires probing identifier predictability, such as looking for sequential IDs, UUID leaks, or encoded identifiers, to assess whether attackers can discover and access other users' objects.

This BOLA testing approach supports horizontal read, write, and delete operations by swapping attacker-authenticated tokens across victim object IDs to verify whether per-object authorization is enforced across all endpoint methods, including method bypass checks.