--- title: A batch ID list still needs per-item authorization description: Bulk endpoints that accept an array of IDs, like a batch invoice export, often authorize the request once for the route instead of checking each identifier... canonical: https://daily.dev/posts/a-batch-id-list-still-needs-per-item-authorization-qjvc58mbj twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: A batch ID list still needs per-item authorization | daily.dev og:description: Bulk endpoints that accept an array of IDs, like a batch invoice export, often authorize the request once for the route instead of checking each identifier... og:url: https://daily.dev/posts/a-batch-id-list-still-needs-per-item-authorization-qjvc58mbj og:image: https://api.daily.dev/og/posts/QjvC58mBJ.png og:image:alt: A batch ID list still needs per-item authorization og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # A batch ID list still needs per-item authorization **[Auth By Example](https://daily.dev/sources/7eadcwhmohx0bchehapmt)** · [@authbyexample](https://daily.dev/authbyexample) · 2 min read · 0 upvotes · 0 comments ## Summary Bulk endpoints that accept an array of IDs, like a batch invoice export, often authorize the request once for the route instead of checking each identifier against the authenticated user, creating a Broken Object Level Authorization (BOLA) vulnerability. An attacker can pad a legitimate ID with others to exfiltrate data they shouldn't see. The fix is to resolve and authorize every ID individually, pick a clear fail-closed or partial-result policy, cap batch size, keep filtering scope consistent with single-resource endpoints, and log denied IDs specifically. A simple test: include one owned ID and one sibling-tenant ID in the same batch and see if both are returned. ## Content Bulk endpoints feel efficient: `POST /invoices/export` with `{ "ids": ["a","b","c"] }`. The bug is authorizing once for the route (or the first ID) and then trusting the rest of the array. That is classic BOLA with a shopping cart — an attacker pads a legitimate ID with neighbors they should not see. Authorize each identifier in the request against the authenticated principal before you load, mutate, or return it: 1. Resolve every ID to a resource, then run `can(user, action, resource)` per item. Do not short-circuit on "at least one allowed." 2. Prefer fail-closed partial results: return only the IDs that passed, or reject the whole batch if any ID fails. Pick one policy and document it; never silently skip unauthorized IDs while still returning 200 with a mixed bag the client cannot audit. 3. Cap batch size. Huge ID lists amplify enumeration and make timeouts hide which checks ran. 4. Keep list filtering and batch fetch consistent. If `GET /invoices` is scoped by tenant/ownership, the batch path must use the same scope — not a privileged "get by primary key" helper. 5. Log denials with the specific resource IDs that failed. A single "export denied" line without IDs makes incident review guesswork. Quick check: include one owned ID and one sibling ID from another tenant in the same batch. If both come back, your gate was "is the user logged in," not authorization. Bulk APIs multiply the blast radius of a missing object check. Authorize the set, not the endpoint. ## Similar posts on daily.dev - [BOLA: Enumerating an Entire Employee Directory Through a Predictable ID](https://daily.dev/posts/bola-enumerating-an-entire-employee-directory-through-a-predictable-id-5lh2ad7fu) · InfoSec Write-ups · 0 upvotes · 0 comments - [Everyone Knows About Broken Authorization – So Why Does It Still Work for Attackers?](https://daily.dev/posts/everyone-knows-about-broken-authorization-so-why-does-it-still-work-for-attackers--exddy4tnt) · Security Boulevard · 1 upvotes · 0 comments - [Agents Turn Broken Auth Into a Breach at Machine Speed](https://daily.dev/posts/agents-turn-broken-auth-into-a-breach-at-machine-speed-ew6xjsbnf) · API Evangelist · 0 upvotes · 0 comments - [IDOR Attacks and the Growing Threat to Your API Security – FireTail Blog](https://daily.dev/posts/idor-attacks-and-the-growing-threat-to-your-api-security-firetail-blog-j3qbtauze) · Security Boulevard · 0 upvotes · 0 comments - [The 5 Most Disastrous API Vulnerabilities](https://daily.dev/posts/the-5-most-disastrous-api-vulnerabilities-aehrfktvw) · Nordic APIs · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#authorization](https://daily.dev/tags/authorization) [View this post on daily.dev](https://daily.dev/posts/a-batch-id-list-still-needs-per-item-authorization-qjvc58mbj) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"DiscussionForumPosting","mainEntityOfPage":"https://daily.dev/posts/a-batch-id-list-still-needs-per-item-authorization-qjvc58mbj","headline":"A batch ID list still needs per-item authorization","text":"Bulk endpoints that accept an array of IDs, like a batch invoice export, often authorize the request once for the route instead of checking each identifier against the authenticated user, creating a Broken Object Level Authorization (BOLA) vulnerability. An attacker can pad a legitimate ID with others to exfiltrate data they shouldn't see. The fix is to resolve and authorize every ID individually, pick a clear fail-closed or partial-result policy, cap batch size, keep filtering scope consistent with single-resource endpoints, and log denied IDs specifically. A simple test: include one owned ID and one sibling-tenant ID in the same batch and see if both are returned.","url":"https://daily.dev/posts/a-batch-id-list-still-needs-per-item-authorization-qjvc58mbj","datePublished":"2026-10-01T08:48:14.301Z","dateModified":"2026-10-01T08:48:31.032Z","author":{"@type":"Person","name":"Auth By Example","url":"https://daily.dev/authbyexample","image":"https://media.daily.dev/image/upload/s--Fgz7IgGQ--/f_auto/v1789653205/avatars/avatar_7EADCwHmOHX0bChEhAPmt?_a=BAMAMicg0","interactionStatistic":{"@type":"InteractionCounter","interactionType":{"@type":"EndorseAction"},"userInteractionCount":30}},"interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"isPartOf":{"@type":"WebPage","url":"https://daily.dev/sources/7eadcwhmohx0bchehapmt","name":"Auth By Example"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Auth By Example","item":"https://daily.dev/sources/7eadcwhmohx0bchehapmt"},{"@type":"ListItem","position":3,"name":"A batch ID list still needs per-item authorization"}]} ```