API5:2023 â Broken Function Level Authorization Â· Slide 12 of 28

Slide 12 · HTTP Verb Manipulation

One URL. Multiple methods. Only some are protected.

Change GET to DELETE. The authorization checked the URL, not the action.

How it works

REST APIs often handle multiple operations on the same resource URL using different HTTP methods. Authorization checks are sometimes implemented per URL, not per URL + method combination. A regular user authorized to GET a resource can DELETE it if the method check is missing.

# The auth middleware checks URL path but not method ALLOWED_USER_PATHS = ["/api/posts/", "/api/users/", "/api/comments/"] def auth_middleware(request): token = validate(request.headers["Authorization"]) if any(request.path.startswith(p) for p in ALLOWED_USER_PATHS): return True # path allowed — but ANY method passes! return check_admin_role(token) # Result: GET /api/posts/123 → 200 OK (reads post — correct) DELETE /api/posts/123 → 200 OK (deletes post — should require admin)

Why this specific failure is common

Developers often add authorization checks when they add a new endpoint. When they later add a new HTTP method to an existing endpoint, the authorization check for the new method is easily forgotten — the route already exists and “has authorization.” The new method inherits the URL’s routing but not necessarily its authorization requirements.

The fix: authorize on method + path, not just path

Authorization checks must be specific to the HTTP method being called, not just the URL being accessed. A role check for GET /api/users is not a role check for DELETE /api/users. Each method on each endpoint is a different function and requires its own authorization decision.

← Back Real incident: GitLab →