From the course: The OWASP API 2023 Top 10: An Overview

Unlock the full course today

Join today to access over 24,100 courses taught by industry experts.

API5:2023 Broken Function-Level Authorization

API5:2023 Broken Function-Level Authorization

From the course: The OWASP API 2023 Top 10: An Overview

Start my 1-month free trial Buy for my team

API5:2023 Broken Function-Level Authorization

“

- Holding onto the fifth spot in the new OWASP API Security Top 10 is Broken Function-Level Authorization. OWASP describes this vulnerability as, "Complex access control policies with different hierarchies, groups, and roles, and an unclear separation between administrative and regular functions, tend to lead to authorization flaws. By exploiting these issues, attackers gain access to other users' resources and/or administrative functions." So before we get into it, let's start with a recap of the previously mentioned Broken Object-Level Authorization, or BOLA, vulnerability. These occur when resources can be accessed without the proper authorization checks, leaving them unprotected. Broken Function-Level Authorization is similar to BOLA but targets the functions of an equal or higher privilege. Think of BFLA as the annoying friend or family member of BOLA that always pretends to be in charge. That's the different…

Contents