API authorization testing (BOLA, BFLA, BOPLA)
API authorization testing checks whether one user can reach another user’s data or an admin-only function. Crossfyre automates it: it replays every discovered endpoint as every identity (admin, user A, user B, anonymous) and diffs the responses to catch BOLA, BFLA, and BOPLA, each confirmed before it is reported.
What is BOLA, BFLA, and BOPLA?
BOLA (broken object-level authorization, OWASP API1) is when user A can read or change user B’s object by changing an ID. BFLA (broken function-level authorization) is when a non-admin can call an admin-only function. BOPLA (broken object property-level authorization, including mass assignment) is when a caller can set a privileged property like role or is_admin and the API accepts it. All three are authorization bugs that generic scanners miss because there is nothing malformed in the request; it is simply the wrong identity.
Why do most scanners miss authorization bugs?
Template and signature scanners look for known-bad patterns in a single request. Authorization bugs have no bad pattern: a perfectly valid request from the wrong identity is the vulnerability. Finding them requires replaying the same request as different users and comparing what comes back, which is a testing model most automated tools do not implement.
How does Crossfyre test authorization?
It runs a differential identity-matrix check: for each endpoint it has discovered, it replays the request as each identity you provide (admin, user A, user B, anonymous) and diffs the responses. When a lower-privileged identity gets data or an action it should not, that is a finding, and every finding goes through a confirm-before-report step. It is also privilege-aware, so an admin legitimately reading a user’s object is not flagged as BOLA.
Do I need an OpenAPI spec?
No. Crossfyre discovers endpoints through distributed recon and authenticated crawling, so it can test authorization even where you do not have or maintain a spec. A spec helps coverage but is not required, which is a difference from spec-first API-security tools.
Frequently asked
Is authorization testing available on the free plan?
It is a Pro-tier capability, enforced server-side. Free workspaces can run distributed recon; authenticated scanning and authorization testing (BOLA/BFLA/BOPLA) unlock on Pro.
How is this different from Burp’s Autorize or 42Crunch?
Autorize is a manual Burp extension you drive by hand; 42Crunch is enterprise and OpenAPI-spec-centric. Crossfyre runs the same class of authorization testing automatically, self-serve, as one stage of a distributed recon pipeline, without a spec or a manual replay session.