API5:2023Broken Function Level Authorization
Slide 2 of 28
Part 1 · What Is It?Slide 2
Slide 2 · The Word
Broken Function Level Authorization.
The right user. The wrong function. No one checked.
What “function level” means

In API security, function level authorization means: does the calling user have permission to perform this specific action?

It’s not about which object they’re accessing (that’s BOLA). It’s not about which properties within an object (that’s BOPLA). It’s about whether they can call this function at all.

Functions restricted by role
DELETE /api/users/{id} — only admins can delete users
GET /api/admin/reports — only admins can view reports
POST /api/users/{id}/ban — only moderators can ban
GET /api/premium/who-swiped — only premium subscribers
POST /api/invoices/{id}/approve — only finance role
What BFLA looks like
Regular user calls DELETE /api/users/{id} — it works
Regular user calls GET /api/admin/reports — gets the report
Free user calls GET /api/premium/who-swiped — sees it free
Guest calls POST /api/invoices/{id}/approve — approved
In all cases: API checked auth token, not role entitlement
The single missing check

Every BFLA vulnerability comes down to one missing step: after verifying the token is valid, the API never asks “what role does this token have, and is that role entitled to call this endpoint?”

← Back See the official definition →
📄 View sources