Broken Function Level Authorization

Broken Function Level Authorization

Overview

BFLA (API Security Top 10 #5) occurs when an API does not properly enforce which users can access which functions. Common manifestations:

• Admin-only endpoints accessible to regular users
• HTTP method confusion: GET /api/users is protected, DELETE /api/users/{id} is not
• Predictable admin paths: /api/v1/admin/users with no role check

Detection Strategy

• Route handlers for admin operations (delete, ban, role-change) without role middleware
• Missing isAdmin, hasRole(), or @PreAuthorize checks on privileged endpoints

Remediation

Apply role-based access control at every sensitive endpoint.

Vulnerable:

app.delete('/api/admin/users/:id', authenticate, async (req, res) => {
    // No admin role check!
    await User.findByIdAndDelete(req.params.id);
});

Safe:

app.delete('/api/admin/users/:id', authenticate, requireRole('admin'), async (req, res) => {
    await User.findByIdAndDelete(req.params.id);
});