PART 4
Prevention
Slides 18–26 · Seven mitigations + the full picture
Slide 18 · Prevention Overview
Seven ways to fix broken function level authorization.
Define who can call what. Enforce it everywhere. Test it explicitly.
🚫
MIT 01 — Deny by Default
Every endpoint returns 403 unless the calling role is explicitly permitted. No role = no access, automatically.
🔑
MIT 02 — Role-Based Access Control (RBAC) at the API Layer
Define roles. Define which roles can call which functions. Enforce the check in the API, not the UI.
📋
MIT 03 — Authorize on Method + Path, Not Just Path
A role check for GET /resource is not a role check for DELETE /resource. Each method-path combination is a distinct function.
🧩
MIT 04 — Centralized Authorization Logic
Don’t duplicate role checks across every controller. One authorization service, enforced consistently across all endpoints.
📝
MIT 05 — Maintain an Explicit Function Permissions Map
A documented, reviewed list of every function and which roles can call it. Makes gaps visible and auditable.
🧪
MIT 06 — Explicitly Test Non-Admin Tokens Against Admin Paths
In your test suite: take a regular user token and try to call every admin endpoint. Expect 403 on all of them. Fail the build if any return 200.
🚨
MIT 07 — Log and Alert on 403s from Suspicious Clients
A spike in 403 responses from one user is a signal they’re probing for unprotected endpoints. Monitor and alert.