Security

Broken Object Property Level Authorization (BOPLA)

Broken Object Property Level Authorization is an API weakness in which the server fails to check whether a user may read or change specific properties of an object they can reach. OWASP lists it as API3 in its 2023 API Security Top 10.

Deep dive

Learn Article

What Is Field-Level Authorization in an API?

Field-level authorization checks each property an API user can read or change. Without it, record access can expose prices, owners and order state.

beginner 5 min read

Back to glossary