  APIs have become the prominent technology of choice for achieving
inter-service communications. The growth of API deployments has driven the
urgency in addressing its lack of security standards. API Security is a topic
for concern given the absence of standardized authorization in the OpenAPI
standard, improper authorization opens the possibility for known and unknown
vulnerabilities, which in the past years have been exploited by malicious
actors resulting in data loss. This paper examines the number one vulnerability
in API Security: Broken Object Level Authorization(BOLA), and proposes methods
and tools to reduce the prevalence of this vulnerability. BOLA affects various
API frameworks, our scope is fixated on the OpenAPI Specification(OAS). The OAS
is a standard for describing and implementing APIs; popular OAS Implementations
are FastAPI, Connexion (Flask), and many more. These implementations carry the
pros and cons that are associated with the OASs knowledge of API properties.
The Open API Specifications security properties do not address object
authorization and provide no standardized approach to define such object
properties. This leaves object-level security at the mercy of developers, which
presents an increased risk of unintentionally creating attack vectors. Our aim
is to tackle this void by introducing 1) the OAS ESS (OpenAPI Specification
Extended Security Scheme) which includes declarative security controls for
objects in OAS (design-based approach), and 2) an authorization module that can
be imported to API services (Flask/FastAPI) to enforce authorization checks at
the object level (development-based approach). When building an API service, a
developer can start with the API design (specification) or its code. In both
cases, a set of mechanisms are introduced to help developers mitigate and
reduce the prevalence of BOLA.
