Blog
Mert Özen's blog posts on software development, backend, frontend, and DevOps.
Closing API1 BOLA Systematically: Tenant/Owner-Scoped Queries, Global Query Filters and Resource-Based Authorization
You close BOLA not by adding a Where to every endpoint but by making scope mandatory in the data access layer: tenant and owner filters with EF Core 10 named query filters, tests that confine unscoped queries to one marked class, relationship checks for sub-resources and bulk operations, the 403/404 split with a resource-based handler, and other-tenant scenarios generated automatically from the matrix.
The API Security Lab: A Multi-Tenant Orders API, an Authorization Matrix and a Security Test Harness
Most API security breaks on the question "whose data is this?", and you only catch it systematically with an authorization matrix kept apart from the code that states the expected status for each endpoint × actor × resource. We build a two-tenant, three-role Minimal API lab, run the matrix with an xUnit Theory, WebApplicationFactory and a test authentication handler, and see eight BOLA holes on the first run.