Modern Single Page Applications (SPAs) and mobile apps rely heavily on REST and GraphQL APIs. Because APIs expose business logic and raw database objects directly to client clients, they have become the top target for cyberattacks.
1. Broken Object Level Authorization (BOLA)
BOLA occurs when an endpoint accepts an object ID (e.g. `/api/orders/1042`) without verifying whether the authenticated user actually owns order `1042`. Attackers iterate IDs to exfiltrate millions of records. Fix BOLA by enforcing object ownership checks at the database query level.
2. Broken Object Property Level Authorization (BOPLA)
Over-fetching or mass-assignment vulnerabilities allow attackers to pass extra JSON parameters (such as `"is_admin": true` or `"discount": 100`) during user profile updates. Always use strict DTO (Data Transfer Object) schemas to filter allowed incoming properties.
3. Rate Limiting & Bot Protection
Unrestricted endpoint access exposes authentication routes to credential stuffing and brute force attacks. Implement sliding-window rate limiters (via Redis or Cloudflare WAF) on sensitive endpoints.
Key Takeaways
- Enforce strict user-to-object ownership authorization on every API endpoint.
- Sanitize incoming API payloads with strict schema validators (DTOs/Zod).
- Implement rate limiting and WAF bot protections on all public endpoints.