API5:2023 â Broken Function Level Authorization Â· Slide 28 of 28

✅

Module Complete

You finished API5 — Broken Function Level Authorization. Here’s what you now understand:

✓What BFLA is — authorization failures at the function level, not the object or property level

✓How it differs from API1 and API3 — wrong function entirely vs. wrong object or wrong fields

✓Two attack patterns: role bypass (regular user calls admin function) and HTTP verb manipulation (change GET to DELETE)

✓Real incidents — Bumble 2020 (free users accessed premium and admin endpoints for 100M+ accounts) and GitLab CVE-2021-4191 (unauthenticated GraphQL query enumerated all users)

✓OWASP scenarios — admin URL discovery, HTTP verb manipulation, workflow bypass via self-approval

✓Seven mitigations: deny by default, RBAC at API layer, method+path authorization, centralized logic, permissions matrix, negative auth testing, and 403 monitoring

The one thing to carry forward

Authentication answers “who are you?” Authorization answers “are you allowed to do this?” Every API function must ask both questions — not just the first one. A valid token is proof of identity, not proof of entitlement. The function check must happen on the server, every request, before the handler runs.

← Back to Quiz Next: API6 — Unrestricted Access to Business Flows →