Fix BOLA (Broken Object Level Authorization) in Laravel

BOLA (Broken Object Level Authorization) is the crown jewel of API exploitation. In Laravel, devs often fall into the 'Implicit Trust' trap—assuming that because a user is authenticated, they have the right to access any ID they pass in the request. If your controller fetches a model by ID and proceeds without checking ownership, you're leaking data and inviting account takeovers. Here is how to kill this vulnerability.

The Vulnerable Pattern

public function update(Request $request, $id) {
    // VULNERABLE: No ownership check. Any user can modify any ticket by guessing the ID.
    $ticket = Ticket::find($id);
    $ticket->update($request->all());
    return response()->json($ticket);
}

The Secure Implementation

To fix BOLA, stop trusting raw IDs from the request. Implement Laravel Policies (php artisan make:policy) to define specific logic for who can view or modify a resource. Use Route Model Binding to inject the model directly into your controller and call $this->authorize() to trigger the policy check. For even tighter security, always scope your database queries through the authenticated user's relationship (e.g., auth()->user()->items()->find($id)) to ensure the database itself enforces ownership boundaries.

public function update(UpdateTicketRequest $request, Ticket $ticket) {
    // SECURE: Laravel Policy handles authorization automatically.
    $this->authorize('update', $ticket);
$ticket->update($request->validated());
return response()->json($ticket);
}
// Or via Scoped Queries:
// $ticket = auth()->user()->tickets()->findOrFail($id);

Prove it on the next pull request

This page is a generated code sketch, not a GuardAPI scan. After you scope the query by tenant, fail the GitHub job when tenant B can still GET tenant A's object. GET-only. Tokens stay in GitHub Secrets.

- uses: GuardAPI/ghost-api@v6
  with:
    api-key: ${{ secrets.GUARD_API_KEY }}
    openapi-path: ./openapi.json
    base-url: ${{ secrets.STAGING_API_URL }}
    token-a: ${{ secrets.TOKEN_USER_A }}
    token-b: ${{ secrets.TOKEN_USER_B }}

Install docs · 14-day trial · How the fail rule works