Blog

Closing API1 BOLA Systematically: Tenant/Owner-Scoped Queries, Global Query Filters and Resource-Based Authorization

You close BOLA not by adding a Where to every endpoint but by making scope mandatory in the data access layer: tenant and owner filters with EF Core 10 named query filters, tests that confine unscoped queries to one marked class, relationship checks for sub-resources and bulk operations, the 403/404 split with a resource-based handler, and other-tenant scenarios generated automatically from the matrix.