10. Broken Object-Level Authorization (BOLA/IDOR) & Role-Based Access Control (RBAC/ABAC) • Git, System Design & Web Security (OWASP Top 10) • Rishabh Ki Kaksha

Git, System Design & Web Security (OWASP Top 10) › 10. Broken Object-Level Authorization (BOLA/IDOR) & Role-Based Access Control (RBAC/ABAC)

40 mins

← Prev Next →

Course Syllabus

Module 1: Git Internals, Plumbing Commands & DAG Graph Architecture

01. Git Internals: Blobs, Trees, Commits & Annotated Tags (The .git Directory Anatomy) 02. Git DAG (Directed Acyclic Graph) & Plumbing Commands (cat-file, hash-object, write-tree) 03. Git Three Trees Architecture: Working Directory, Staging Index & HEAD

Part 1: Git Mastery, Security Defense & Caching

Module 2: Advanced Branching Strategies & Disaster Recovery

04. Advanced Rebasing: Interactive Rebase (squash, edit, fixup) vs Merge 05. Git Disaster Recovery: git reflog, Cherry-Pick & Recovering Deleted Commits/Branches 06. Enterprise Branching: Trunk-Based Development vs GitFlow vs Feature Flag Architecture

Module 3: Web Application Security: OWASP Top 10 Defenses

07. OWASP #1 & #3: SQL Injection (SQLi) & Server-Side Request Forgery (SSRF) Hardening 08. Cross-Site Scripting (XSS): Stored, Reflected, DOM-based & Content Security Policy (CSP) 09. CSRF vs Cross-Origin Traps: SameSite Cookies, Anti-CSRF Tokens & CORS Preflight Rules 10. Broken Object-Level Authorization (BOLA/IDOR) & Role-Based Access Control (RBAC/ABAC)

Module 4: Cryptography, PKI, SSL/TLS & Mutual Auth (mTLS)

11. Asymmetric Cryptography (RSA vs ECC) & Digital Signatures with GPG Keys 12. Public Key Infrastructure (PKI), TLS 1.3 Handshake & Let's Encrypt Automation 13. Mutual TLS (mTLS) for Zero-Trust Service-to-Service Communication

Module 5: DevSecOps, Secret Scanning & Zero-Trust Security Architecture

14. Automated Secret Scanning (Gitleaks, Trufflehog) & Git Pre-Commit Hooks 15. Software Supply Chain Security: Dependabot, SBOM (Software Bill of Materials) & Signed Commits 16. Enterprise Zero-Trust Architecture: Cloud IAM, Bastion Hosts & WireGuard VPN Networks

Interactive Lesson Studio

# 10. Broken Object-Level Authorization (BOLA/IDOR) & Role-Based Access Control (RBAC/ABAC)

> Git & Web Security Notes by Rishabh - Topic 10

---

### 1. BOLA / IDOR (The #1 API Security Vulnerability 🕳️)

**Insecure Direct Object Reference (IDOR / BOLA):**
> Attacker URL me document ID badal kar doosre user ka private invoice/medical record download kar leta hai:  
> `GET /api/invoices/1001` ➔ `GET /api/invoices/1002` (Unauthorized Access!).

```typescript
// ❌ VULNERABLE TO IDOR:
app.get("/api/invoices/:id", async (req, res) => {
    const invoice = await db.invoices.findUnique({ where: { id: req.params.id } });
    return res.json(invoice); // Returns data without checking ownership!
});

// ✅ SECURE OWNERSHIP CHECK:
app.get("/api/invoices/:id", async (req, res) => {
    const invoice = await db.invoices.findFirst({
        where: {
            id: req.params.id,
            userId: req.user.id // 🛡️ Restricts query to currently logged-in user!
        }
    });
    if (!invoice) return res.status(404).json({ error: "Invoice not found" });
    return res.json(invoice);
});
```

---

### 2. RBAC vs ABAC Access Control Models 🏢

*   **RBAC (Role-Based Access Control):** Permissions roles se bind hoti hain (`User.hasRole("ADMIN")`).
*   **ABAC (Attribute-Based Access Control - Granular):** Contextual rules evaluate hoti hain: *"User document edit kar sakta hai IF department == 'Finance' AND time < '18:00' AND location == 'IN'"*.

---

### 3. Master Comparison Matrix

---

### 4. Interview Ke 3 Sawal Is Topic Se

1. **Auto-incrementing numeric IDs (`/user/101`) ke badle UUID v4 / ULID kyu use kiye jaate hain?** -> Enumeration attacks rokne ke liye taaki attacker loop chala kar saare records scrape na kar sake.
2. **Horizontal Privilege Escalation aur Vertical Privilege Escalation me kya difference hai?** -> Horizontal me user same level ke doosre user ka data access karta hai (IDOR); Vertical me normal user Admin permissions acquire kar leta hai.
3. **Policy-as-Code (Open Policy Agent - OPA) ka kya fayda hota hai?** -> Authorization logic ko application code se separate karke centralized declarative policies me manage karna.

---
**Next Topic:** 11. Asymmetric Cryptography (RSA vs ECC) & Digital Signatures with GPG Keys

Loading lesson content...

Python 3.12

Full IDE

Live Execution Terminal

Click "Execute Live" to run code.
                

Lesson Mastery AI Quiz

AI Doubt Solver

CERTIFICATE OF COMPLETION

Rishabh Gehlot

PHP 8+ & Laravel 11 Master Track