# BOLA and IDOR: review the actual object

https://thiago.limaesilvatecnologia.com.br/en/artigos/object-authorization/

Published: 2026-09-12

Knowing an identifier is not authorization evidence.

Content produced with AI assistance for Thiago Silva’s website. Independent editorial analysis; it does not represent clients or employers.

Reading-path month: April 2026

Collection published on September 12, 2026. Months organize the reading path; they are not earlier publication dates.

A short architecture article. The technical reference supports the topic; hypothetical scenarios and assessment proposals are editorial analysis, not accounts of personal implementations.

## The architecture decision

An API can identify a user correctly and still return another account's object. Review must link identity to the requested resource, including exports and batch operations.

## Practical application

Editorial proposal: create synthetic data with two users and separate resources. Explain the relationship permitting every operation. A hard-to-guess identifier must not replace this decision.

## How to verify

Repeat the journey changing only the object while retaining the session. Include indirect relationships such as order attachments. Record rejection and absence of side effects. Demonstrate actual isolation, not merely an interface error message.

## Sources

- [OWASP — Insecure Direct Object Reference Prevention Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Insecure_Direct_Object_Reference_Prevention_Cheat_Sheet.html). Accessed: 2026-09-12.

[Profile: Thiago Silva | Cyber Architect](https://thiago.limaesilvatecnologia.com.br/en/perfil/)