Modern API Security: Deep Dive into BOLA (IDOR) and Mass Assignment

As modern architectures shift towards decoupled microservices, APIs have become the primary entry point for attackers. Among the OWASP API Security Top 10, Broken Object Level Authorization (BOLA) and Mass Assignment remain the most critical flaws.

BOLA occurs when an API endpoint accepts an object identifier (e.g., /api/v1/user/1023/profile) but does not validate if the logged-in user has permission to access that specific resource. An attacker can simply iterate the ID to download sensitive data of other users.

Mass assignment happens when client input is automatically bound to database models without filtering. For example, if a user updates their profile and posts:

{
  "email": "user@example.com",
  "isAdmin": true
}

If the backend binds the entire object directly, the user successfully elevates their privileges to admin.

To remediate mass assignment, developers should define strict Data Transfer Objects (DTOs) and manually bind variables rather than performing raw object mapping. For instance, in Node/Express:

// VULNERABLE
User.findByIdAndUpdate(req.user.id, req.body);

// SECURE
const updateData = {
  email: req.body.email,
  displayName: req.body.displayName
};
User.findByIdAndUpdate(req.user.id, updateData);

This prevents client-side parameters from modifying sensitive properties like roles, balance, or flags.