SESSIONS · MFA · OAUTH · BOLA

Authentication and Authorization Testing

Test identity, sessions, MFA, OAuth, BOLA, and BFLA with controlled accounts and evidence that proves the server-side decision.

Login success proves little. Test how the server establishes identity, maintains sessions, and authorizes every object and action.

PHASE 01

Build an identity matrix

Create test accounts across roles, tenants, and lifecycle states. List every sensitive object and action each account should and should not access.

  • Include suspended, unverified, and MFA-enabled accounts.
  • Record ownership for each test object.
API Security Checklist →

PHASE 02

Test sessions, MFA, and OAuth

Check rotation on login and privilege change, logout invalidation, reset flows, MFA recovery, OAuth redirect validation, state, nonce, issuer, and audience.

  • Replay an old session after password reset.
  • Attempt approved negative tests for MFA and OAuth callbacks.
Payload Cheatsheets →

PHASE 03

Prove BOLA and BFLA safely

Replay the same request as a peer account and a lower-privilege account. Test reads, writes, deletes, exports, and hidden APIs.

  • Change identifiers and methods independently.
  • Verify enforcement server-side, not only in the UI.
Security Report Templates →

Frequently asked questions

What is the difference between BOLA and BFLA?

BOLA is unauthorized access to a specific object. BFLA is unauthorized access to a function or action.