​

What are BOLA, IDOR, and BOPLA, and how does Qodex test for them?

BOLA, IDOR, and BOPLA are authorization bugs. They happen when an API lets one user access an object, action, or field they should not be allowed to access.

​

What the terms mean

BOLA and IDOR are closely related. BOPLA focuses on fields and properties, not just object ids.

​

How Qodex tests BOLA and IDOR

Qodex needs at least two auth profiles, such as userA and userB. The test shape is:

1. Authenticate as User A.
2. Create or read a resource and capture its id.
3. Switch to User B.
4. Request the same resource id as User B.
5. Expect the app to return 403 or 404.

If the app returns 200 with User A’s data, Qodex can open a security finding.

​

How Qodex tests BOPLA

For excessive data exposure, Qodex compares response fields against what the caller should see. Fields like password_hash, private user data, internal ids, or admin-only values are suspicious. For mass assignment, Qodex sends protected fields such as role: "admin" or isAdmin: true, then follows up to check whether the value persisted.

​

Why auth profiles matter

A single shared admin token cannot prove cross-user authorization. Create separate auth profiles for roles such as admin, user, viewer, and another normal user. Qodex uses those profiles to test whether permissions are enforced across real role boundaries.

​

Next steps