Watch: BOLA + BFLA Exploited Live

You just walked the OWASP API Top 10 on paper and mapped seeded flaws to their categories. This video shows the two most damaging of them actually happening. Both are authorization failures — the API knows exactly who the caller is and never checks what they're allowed to reach — and both are exploited against PayLoop, the same mock invoicing API from the exercise.

Watch for the moment that defines API security: the attacker is fully authenticated the entire time. No malware, no stolen password — just a logged-in user changing one value. First BOLA (API1, Broken Object Level Authorization): incrementing an invoice id to read another company's records. Then BFLA (API5, Broken Function Level Authorization): a regular user calling an admin-only refund endpoint that only checks the token, not the role.

Pay attention to how each fix lands on the same two beats the written lessons keep returning to: the control (authorization checked on the server, per request, against the specific object or function, deny by default) and the evidence (a CI test that returns 404/403 for the unauthorized caller, plus the endpoint-to-role matrix) — the artifacts that prove to an auditor the control actually operates.

What to carry forward

BOLA reaches another user's object; BFLA reaches an admin function. They are the same mistake wearing different clothes — authenticated, but never authorized. The rule for every endpoint you review is the one the video ends on: authorization is enforced on the server, on every request, against the specific object or function, and denied by default — and you keep the test that proves it. Next is the gateway layer, where many of these controls get enforced in one place.