BOLA: The Vulnerability That Won't Die
Broken Object-Level Authorization is deceptively simple. User A requests /api/users/123 and gets their own data. Then they change the URL to /api/users/124 and get someone else's data. That's it. No exploit kit, no zero-day, no sophisticated tooling. Just incrementing an ID.
And yet BOLA has been the number one API vulnerability on the OWASP API Security Top 10 for three consecutive releases. It's responsible for more data breaches than SQLi and XSS combined in API-first applications. The reason it persists is that BOLA is an authorization logic bug, not a code vulnerability — it can't be caught by static analysis or traditional scanning.
How Behavioral Detection Catches What Scanners Miss
1-SEC's API Fortress module watches API traffic patterns, not individual requests. A single request to /api/users/124 is normal. But a sequence of requests to /api/users/124, /api/users/125, /api/users/126 from the same session — that's enumeration, and it gets flagged immediately.
The module also validates requests against your OpenAPI specification. If your spec says the /admin endpoint requires an admin role but a regular user is hitting it, that's a schema violation that indicates either a misconfiguration or an active attack.
Shadow API Discovery
APIs that exist but aren't documented are APIs that aren't secured. 1-SEC discovers shadow APIs by monitoring actual traffic and comparing it against your documented endpoints. Every undocumented endpoint is a potential attack surface that bypasses your security controls.
Rate Limiting Per Endpoint
Different endpoints deserve different rate limits. A login endpoint should allow maybe 5 attempts per minute. A search endpoint might allow 100. A health check can be unlimited. 1-SEC applies per-endpoint rate limiting based on the sensitivity and expected usage pattern of each API route.
API Security Checklist for 2026
Validate authorization on every request, not just at the gateway. Use unpredictable identifiers instead of sequential IDs. Implement field-level authorization so users only see the data they're supposed to. Monitor for enumeration patterns. Document every endpoint and kill shadow APIs. And make sure your API security tool runs inline, not as an after-the-fact log analyzer — by the time you analyze the log, the data is already gone.