What are the risks of broken function level authorization in APIs?

All answers to this question.

Broken function level authorization occurs when an application relies on the UI to hide admin features rather than validating roles on the server side. Developers might make an endpoint like /api/v1/users require admin rights, but then create an endpoint like /api/v1/admin/deleteUser and forget to restrict it. Attackers can guess these URL patterns or read documentation files to find hidden paths. They then send direct API requests to execute administrative commands that their normal user account should never be allowed to run.

   Answered 2025-01-25 by Stephanie Page

Is it better to use a Role-Based Access Control system for this, or should we move toward a more granular Attribute-Based Access Control model instead?

   Answered 2025-01-26 by Ronald Fischer

• For most applications, Role-Based Access Control is completely sufficient as long as it is systematically enforced at the global controller level. Attribute-Based Access Control is great but adds massive complexity that you only really need for highly dynamic enterprise environments.

     Commented 2025-01-28 by Douglas Newman

The fundamental problem is adopting a default-allow security posture. Instead, your backend framework should default to denying all API access unless explicit permissions are specified.

   Answered 2025-01-29 by Rebecca Floyd

• Completely agree, Rebecca. A deny-by-default architecture ensures that even if a developer forgets to add security annotations to a new endpoint, it remains closed to the public.

     Commented 2025-01-30 by Bradley Myers