From Dev.to
BOLA, the #1 API Vulnerability: a One-Line Fix and an A-B Test in Go and PHP
An invoicing application exposes an API: web addresses, or URLs, that other programs call to read or change invoices. Bob is logged in with his account. He asks for his invoice at the URL GET /invoice...