Fix BOLA (Broken Object Level Authorization) in Laravel

BOLA (Broken Object Level Authorization) is the crown jewel of API exploitation. In Laravel, devs often fall into the 'Implicit Trust' trap—assuming that because a user is authenticated, they have the right to access any ID they pass in the request. If your controller fetches a model by ID and proceeds without checking ownership, you're leaking data and inviting account takeovers. Here is how to kill this vulnerability.

The Vulnerable Pattern

public function update(Request $request, $id) {
    // VULNERABLE: No ownership check. Any user can modify any ticket by guessing the ID.
    $ticket = Ticket::find($id);
    $ticket->update($request->all());
    return response()->json($ticket);
}

The Secure Implementation

To fix BOLA, stop trusting raw IDs from the request. Implement Laravel Policies (php artisan make:policy) to define specific logic for who can view or modify a resource. Use Route Model Binding to inject the model directly into your controller and call $this->authorize() to trigger the policy check. For even tighter security, always scope your database queries through the authenticated user's relationship (e.g., auth()->user()->items()->find($id)) to ensure the database itself enforces ownership boundaries.

public function update(UpdateTicketRequest $request, Ticket $ticket) {
    // SECURE: Laravel Policy handles authorization automatically.
    $this->authorize('update', $ticket);
$ticket->update($request->validated());
return response()->json($ticket);
}
// Or via Scoped Queries:
// $ticket = auth()->user()->tickets()->findOrFail($id);