API5:2023 â Broken Function Level Authorization Â· Slide 4 of 28

Slide 4 · BFLA vs. API1 vs. API3

Three authorization failures. Three different levels.

All look like “access control problems.” They break at completely different places.

API1 — BOLA (Object Level)

Wrong object — same function, different ID

GET /users/1042 — you own user 1041

The endpoint is legitimate; the ID is wrong

Fix: check ownership per request

API3 — BOPLA (Property Level)

Wrong fields — right object, wrong properties

PUT /users/1041 + body: isAdmin=true

The endpoint is legitimate; the fields are wrong

Fix: allowlist fields per user role

API5 — BFLA (Function Level)

Wrong function entirely — the endpoint itself is off-limits for this user’s role.

You call DELETE /api/admin/users/1041 as a regular user. The object ID might be correct. The fields might be fine. But this function — deleting any user — requires admin role. The regular user token has no entitlement to call this endpoint at all.

Fix: check role entitlement before executing any privileged function.

They compound each other

An attacker who finds BFLA on an admin endpoint can combine it with BOLA to affect any user’s data. Each broken authorization layer multiplies the impact of the others.

← Back Why does this keep happening? →