What API5:2023 Broken Function Level Authorization requires
OWASP API Security Top 10 (2023) API5:2023 Broken Function Level Authorization. The best way to find broken function level authorization issues is to perform a deep analysis of the authorization mechanism while keeping in mind the user hierarchy, different roles or groups in the application, and asking the following questions: * Can a regular user access administrative endpoints? * Can a user perform sensitive actions (e.g. creation, modification, or deletion ) that they should not have access to by simply changing the HTTP method (e.g. from `GET` to `DELETE`)? * Can a user from group X access a function that should be exposed only to users from group Y, by simply guessing the endpoint URL and parameters (e.g. `/api/v1/users/export_all`)? Don't assume that an API endpoint is regular or administrative only based on the URL path. While developers might choose to expose most of the administrative endpoints under a specific relative path, like `/api/admins`, it's very common to find these administrative endpoints under other relative paths together with regular endpoints, like `/api/users`. This category sits within the OWASP API Security Top 10 (2023 edition), the canonical industry list of the ten most critical API security risks. Organizations implementing API services should treat each of the ten categories as both a design constraint and a continuous-monitoring obligation, with policies, automated testing, and incident response procedures defined per category.
Pillar: Cybersecurity · Authority: OWASP Foundation (Open Worldwide Application Security Project) · Version: 1.0.0 · Last updated:
Primary source: https://owasp.org/API-Security/editions/2023/en/0xa5-broken-function-level-authorization/
SHA-256 integrity: 46d2eb563e9b689802627b05fde6c79ec6e72f02b784fca28d5d6c76e1f90bb1
Primary Citations — 11 traced to source
- OWASP API Security Top 10 (2023), API05:2023 Broken Function Level Authorization, How To Prevent: 'The enforcement mechanism(s) should deny all access by default, requiring explicit grants to specific roles for access to every function.'
- OWASP API Security Top 10 (2023), API05:2023 Broken Function Level Authorization, How To Prevent: 'Review your API endpoints against function level authorization flaws, while keeping in mind the business logic of the application and groups hierarchy.'
+ 9 more citations (full bibliography, deterministic workflow, actionable schema and crosswalks) included in the vault unlock — $0.01 via Skyfire / L402 / Direct Base USDC.
Access
- Discovery (free): /api/v1/nodes/owasp-api-top-10-2023-api05-broken-function-level-authorization.json — 6-field metadata
- Vault (full node): /api/v1/vault/nodes/owasp-api-top-10-2023-api05-broken-function-level-authorization.json — full 13-key payload, $0.01 USDC (L402/Skyfire/Direct Base)
- Canonical URL: https://bidda.com/intelligence/owasp-api-top-10-2023-api05-broken-function-level-authorization
- Back to registry: Browse all 10,090 compliance nodes