BOLA, the #1 API Vulnerability: a One-Line Fix and an A-B Test in Go and PHP
Change one ID in the URL and the API returns someone else's invoice. The fix is one line; the A-B test, with two users, proves it is in place: in Go with httptest, in Symfony with a Voter and a WebTestCase.
🎯 Vulnerability: Insecure Direct Object Reference (IDOR)
💡 Defense Fix: Enforce object-level access control checks (ABAC/RBAC) on the server side for every API request.