Fix BOLA (Broken Object Level Authorization) in FastAPI
BOLA (Broken Object Level Authorization) is the crown jewel of API exploitation. It occurs when an endpoint exposes a resource via an identifier (like /api/orders/123) but fails to verify if the authenticated user actually owns that resource. In FastAPI, this usually stems from blindly trusting path parameters and failing to enforce ownership checks at the database query level.
The Vulnerable Pattern
@app.get("/invoice/{invoice_id}")
async def get_invoice(invoice_id: int, db: Session = Depends(get_db)):
# VULNERABLE: Only checks if the invoice exists, not who it belongs to.
invoice = db.query(Invoice).filter(Invoice.id == invoice_id).first()
if not invoice:
raise HTTPException(status_code=404)
return invoiceThe Secure Implementation
The fix moves authorization from a 'check' to a 'constraint'. By injecting the authenticated `current_user` and including their unique ID in the database filter, we ensure the application logic is physically incapable of retrieving another user's data. Hardening tip: Use UUIDs instead of sequential integers for IDs to make brute-forcing harder, but never rely on 'security by obscurity'—always enforce the ownership check in the query.
@app.get("/invoice/{invoice_id}")
async def get_invoice(
invoice_id: int,
current_user: User = Depends(get_current_active_user),
db: Session = Depends(get_db)
):
# SECURE: Query includes the owner_id constraint to ensure authorization.
invoice = db.query(Invoice).filter(
Invoice.id == invoice_id,
Invoice.owner_id == current_user.id
).first()
if not invoice:
# Return 404 instead of 403 to prevent ID enumeration
raise HTTPException(status_code=404, detail="Invoice not found")
return invoice</code></pre>
Your FastAPI API
might be exposed to BOLA (Broken Object Level Authorization)
74% of FastAPI apps fail this check. Hackers use automated scanners to find this specific flaw. Check your codebase before they do.
Free Tier • No Credit Card • Instant Report
Verified by Ghost Labs Security Team
This content is continuously validated by our automated security engine and reviewed by our research team. Ghost Labs analyzes over 500+ vulnerability patterns across 40+ frameworks to provide up-to-date remediation strategies.