Home▸Cybersecurity▸Broken Object-Level Authorization (BOLA/IDOR)

Broken Object-Level Authorization (BOLA/IDOR) Simulator

Interactive BOLA/IDOR simulator: log in as one customer, sweep an API's resource-ID parameter and watch a vulnerable endpoint leak every other customer's private records while a secure endpoint enforces object-level authorization and rejects them.

Cybersecurity3DModerate60 FPS

A resource-fetching API endpoint like GET /api/orders/{id} needs two separate checks: authentication (is this a real logged-in user?) and object-level authorization (does this specific user own this specific requested resource?). This simulator logs you in as one customer and lets you sweep the target order ID against a vulnerable API — which checks only authentication and blindly returns whatever ID you ask for — or a secure API, which additionally verifies object ownership and rejects every ID that isn't yours. Watch a live feed of harvested private records accumulate as you enumerate IDs against the vulnerable endpoint, and compare it against the secure endpoint's clean run of 403 rejections.

⚙ Under the hood

Log in as one customer and sweep an API's order-ID parameter against a vulnerable endpoint that checks only authentication and leaks every other customer's private records, or a secure endpoint that also enforces object-level authorization and rejects every ID that isn't yours with 403 — watch a live harvested-records feed and a harvested-vs-denied count compare the two.

Three.jscybersecurityAPI securityBOLAIDORauthorizationOWASP

3D · Three.js / WebGL renderer · 60 FPS target · runs fully client-side, no install