Skip to main content
availability

Deployment: Invicti Platform on-demand, Invicti Platform on-premises

Configure API authorization for access control testing

To effectively test for access control vulnerabilities like BOLA, IDOR, and BFLA, you need to configure multiple sets of API authorization credentials in Invicti Platform. This enables multi-session scanning that can detect both horizontal and vertical access control issues.

This document provides step-by-step instructions for setting up authorization credentials and best practices for comprehensive access control testing.

Prerequisites

Before configuring API authorization, ensure you have:

  • An API target with its API specification imported or linked - see add an API target
  • Test user accounts created in your application with appropriate privilege levels
  • Access to the authentication credentials for these test accounts

Why this matters​

Access control flaws like BOLA, IDOR, and BFLA top the OWASP API Security Top 10, and a single set of credentials can't reveal them - detecting them means comparing what one user can reach against what another user should be able to reach. Configuring several accounts at different privilege levels is what lets Invicti make that comparison and surface horizontal and vertical access control issues before an attacker does. Getting this setup right is the difference between a scan that meaningfully tests authorization and one that silently skips it.

Supported authorization methods​

Invicti Platform supports multiple authorization methods for API access control testing. When configuring credentials for your API scans, you can choose from the following authentication types:

API key authentication​

Provide the key-value pair required by your API. This method is commonly used for APIs that require an API key in headers or query parameters.

Example configuration:

  • Key: X-API-Key
  • Value: abc123def456ghi789

Basic authentication​

Provide a username and password combination that gets encoded in Base64 and sent in the Authorization header.

Example configuration:

  • Username: testuser@company.com
  • Password: SecurePassword123

Bearer token authentication​

Provide a bearer token (such as JWT tokens) that gets sent in the Authorization header with the "Bearer" prefix.

Example configuration:

  • Token: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...

OAuth 2.0 support​

For APIs using OAuth 2.0 flows, you can provide the resulting access tokens as bearer tokens after completing the OAuth flow outside of Invicti.

Choosing the right method

Select the authorization method that matches your API's authentication requirements. If your API supports multiple methods, choose the one that provides the most comprehensive access to test endpoints.

Credential configuration for comprehensive testing​

To test for both horizontal and vertical access control issues, configure your API scan with three sets of credentials:

  • User A (low privilege) - Regular user account
  • User B (low privilege) - Another regular user account at the same privilege level
  • Admin A (high privilege) - Administrative or privileged user account

With this configuration, Invicti:

  • Uses User A and User B credentials to test for horizontal access control issues
  • Uses User A and Admin A credentials to test for vertical access control issues

Step-by-step configuration process​

Configure the credential sets in the target's Authentication settings. For the full field-by-field walkthrough, refer to the IDOR/BOLA authentication document.

  1. Select Inventory > Targets from the left-side menu, then click the three-dot menu (⋮) > Edit target by your API target.
  2. Under Target Settings, select Authentication, then choose IDOR / BOLA authentication from the Authentication method dropdown.
  3. Enter one credential set per user, mapping your test accounts to the user roles in the form:
    • Two Standard users for horizontal access control testing.
    • One Admin user for vertical access control testing.
  4. For each user, enter a Name, select the Authorization type (API key, Basic authentication, or Bearer token), then provide the credentials.
  5. On the Summary step, set one credential as the Default, then click Save target configuration. Invicti sends the credentials to the scan preparator.
Manage credentials from the API catalog

You can also add or edit these credentials from Inventory > API catalog using the three-dot menu next to your API. For details, refer to the Add, edit or delete API authorization document.

User account requirements​

When creating test accounts for access control testing, ensure:

For regular users (User A and User B):

  • Both accounts have identical permission levels
  • Each user has access to their own data/resources
  • Users can't access each other's data in a properly secured system
  • Both users can perform the same operations (read, write, delete) on their own resources

For admin user (Admin A):

  • Has elevated privileges compared to regular users
  • Can access administrative functions or privileged data
  • May have permissions to view/modify other users' data
  • Can perform operations that regular users can't

Example user setup for an e-commerce API:

Alternative configuration

If providing three sets of credentials isn't feasible, you can use two sets of credentials (one low-privilege user and one admin). However, this approach requires running two separate scans:

  • One scan to test for horizontal access control issues (using two low-privilege accounts)
  • Another scan to test for vertical access control issues (using one low-privilege and one high-privilege account)

Best practices for credential setup​

To ensure effective access control testing with Invicti Platform, follow these best practices:

Account setup best practices​

  • Use realistic test data: Configure test accounts with realistic user data to better simulate real-world scenarios
  • Maintain credential separation: Ensure test accounts are completely separate and don't share any identifiers or tokens
  • Test account isolation: Verify that your test accounts truly have the intended privilege levels before running scans
  • Regular credential rotation: Update test credentials regularly to ensure they remain valid throughout testing

Testing coverage recommendations​

  • Test all user roles: Include credentials for every user role type in your application (customer, employee, manager, admin, etc.)
  • Cover different data types: Ensure test users have access to different types of sensitive data (personal info, financial data, system configs)
  • Include edge cases: Test boundary conditions such as newly created accounts or accounts with mixed permissions

Scan configuration tips​

  • Run separate scans when needed: If providing three credential sets isn't feasible, run dedicated horizontal and vertical access control scans
  • Monitor scan coverage: Review scan results to ensure all critical endpoints were tested with multiple user sessions
  • Schedule regular testing: Run access control scans regularly, especially after application updates or user role changes

Validating your setup​

Before running production scans, validate that your access control testing configuration is working correctly:

Pre-scan validation checklist​

  • Test credentials manually: Verify each set of credentials works by making manual API calls
  • Confirm privilege separation: Ensure regular users cannot access admin resources manually
  • Verify cross-user restrictions: Confirm that User A cannot access User B's data through normal application usage
  • Test endpoint coverage: Ensure your API has endpoints that would be vulnerable to access control issues (endpoints with object IDs, user-specific data, admin functions)

Minimum testing requirements​

For effective access control vulnerability detection, ensure your setup meets these minimum requirements:

Essential components:

  • At least 2 user accounts (preferably 3 for comprehensive testing)
  • User accounts with different privilege levels (regular users + admin)
  • APIs with user-specific data and identifiable object references
  • Test data associated with each user account

Recommended components:

  • Multiple data types per user (profile, orders, documents, etc.)
  • Admin-only endpoints and functions
  • APIs that modify or delete data
  • Mix of resource types (individual records, collections, system settings)

Testing effectiveness indicators​

A successful access control testing setup should result in:

  • Scan logs showing multiple authenticated sessions
  • Detection of endpoints with object identifiers (IDs, GUIDs, usernames)
  • Coverage of both read and write operations
  • Testing of both horizontal and vertical access scenarios
Validation tip

After running your first access control scan, review the scan logs to confirm that Invicti successfully authenticated as multiple users and tested cross-session access to various endpoints. If you see limited cross-session testing, review your credential configuration and endpoint coverage.

Troubleshooting​

The scan runs but reports no access control vulnerabilities

Access control detection depends on comparing sessions, so it needs at least two enabled credential sets at meaningfully different privilege levels. Confirm that two or more users are enabled on the Summary step and that a Default is set. If you're running the two-scan approach, make sure each scan pairs the intended accounts (two low-privilege users for horizontal testing, one low-privilege and one admin for vertical testing).

A scan can't reach protected endpoints even though credentials are configured

The API may expect the credentials in a different form than the one selected. Reopen the target's Authentication settings and confirm the Authorization type and values match what the API requires. Then use the pre-scan validation checklist above to test each credential set manually before scanning.

Next steps​

Once you've configured your API authorization credentials, you're ready to:

  1. Run access control scans: refer to scan and troubleshoot API access control issues
  2. Understand the vulnerabilities: Review understanding API access control vulnerabilities
  3. See the complete overview: API access control testing overview

Need help?​

Invicti Support team is ready to provide you with technical help. Go to Help Center

Last updated on
Was this page useful?