Security Arena — Web & API Lab
Test your security instincts in a safe, controlled training environment. Inspect raw HTTP request and response structures, detect authorization defects and header anomalies, and validate your findings.
Challenge Catalog
Broken Object Level Authorization (BOLA) in Order Receipt API
JWT Algorithm "none" Signature Bypass
Rate Limiting Bypass via Spoofed X-Forwarded-For Header
Mass Assignment Flaw in User Account Profile Update
Broken Object Level Authorization (BOLA) in Order Receipt API
You are auditing an e-commerce API. An authenticated customer (Account ID: 501) requests their receipt via GET /api/v1/orders/10482. Notice the sequential order ID in the URL path and the customer ID returned in the JSON payload.
Examine the request and response below. Determine why an attacker with valid credentials can access other customers orders. What is the authorization flaw called in the OWASP API Top 10?
Look at how the resource ID (10482) is passed directly in the URL path without any contextual authorization check linking it to the authenticated session bearer token.
{
"order_id": 10482,
"customer_id": "cust_501",
"total_cents": 14950,
"shipping_address": "742 Evergreen Terrace, Springfield",
"payment_method": "VISA ending in 4012",
"item_count": 3,
"download_token": "FEKO{bola_order_id_sequential_leak}"
}