Active defense: introducing a stateful vulnerability scanner for APIs

Cloudflare launched beta of Web and API Vulnerability Scanner beta launch announced for Cloudflare's Web and API Vulnerability Scanner.

Scanner scope starts with BOLA detection initial scans focus on Broken Object Level Authorization from OWASP API Top 10.

Availability will be available first to API Shield customers first release targeted at API Shield customers.

Vulnerability type BOLA involves valid authenticated requests that bypass authorization checks, attack uses another user's resource identifier while presenting a valid token.

API developer fix can implement a user ID authorization check example code: if (order.userID != user.ID) throw Unauthorized.