Ownership, BOLA/IDOR and tenant isolation

Prevent access through another user’s ID on the server.

UnderstandStudy an examplePractise

Understand the concept

BOLA is missing object-level authorisation; IDOR is a familiar direct-reference manifestation. Changing /cv/42 to /cv/43 is just a URL edit. Without ownership checks it can expose another person’s data. UUIDs do not remove the need for access control.

Derive tenant identity from verified context rather than blindly trusting a submitted tenantId. Scope queries by resource and access boundary, then evaluate the requested operation. Protect ownership changes, nested relationships and bulk exports. Restrict updateable fields to avoid mass-assignment problems.

Files, storage links and background-job results are access paths too. A public storage URL can defeat a well-protected API. Include tenant boundaries in cache and job design. Test owned, foreign-owner, foreign-tenant and missing resources separately, using consistent concealment where appropriate.

WHEN TO USE IT

For multi-tenant SaaS, CVs and private file access.

COMMON PITFALL

Treating UUIDs, storage URLs or tenant headers as sufficient security.

01 / PRACTICE

One topic. Three levels of depth.

HTTP / illustrative example

WHERE Id = @id AND TenantId = @verifiedTenant

A scoped query using a tenant from verified context.

This page does not send requests to external servers. Messages are readable HTTP/1.1 illustrations, not HTTP/2 or HTTP/3 wire dumps. example.test is reserved for examples. Run commands and JavaScript only in your own test environment; never publish real tokens or cookies.

02 / YOUR TURN

Try it yourself first.

The API is protected but its file URL is public. Is access control complete?

Show the solution and explanation

Worked solution

No: protect or appropriately scope the file delivery path.

No. The data can still be disclosed through the file path.

RasimAtaberkŞahin

Understand the concept

One topic. Three levels of depth.

Try it yourself first.