BOLA and IDOR: review the actual object
Knowing an identifier is not authorization evidence.
API security
Object access control, integrations and operation integrity in APIs.
Reading on this topic
REST APIs: protect operation order
Individually correct endpoints can form an incorrect workflow.
SSRF: fetching a URL grants network capability
The feature needs destination and behavior boundaries.
Transactions: confirmation must represent execution
Users should authorize the parameters producing the effect.
Thiago Lima Soneti da Silva (Thiago Silva) — Cyber Architect and technical lead at Lima e Silva Tecnologia.