Access Control: Broken Function Level Authorization¶

Identifier: broken_function_level_authorization

Scanner(s) Support¶

Description¶

Broken Function Level Authorization occurs when callers can invoke functions, endpoints, mutations, or administrative actions they are not allowed to use.

How we test: We replay privileged or role-specific actions across users, roles, transports, and request variants to detect functions that execute without enforcing the caller's authorization.

References:

• https://owasp.org/API-Security/editions/2023/en/0xa5-broken-function-level-authorization/
• https://owasp.org/www-project-web-security-testing-guide/latest/4-Web_Application_Security_Testing/05-Authorization_Testing/02-Testing_for_Bypassing_Authorization_Schema

Configuration¶

Example¶

Example configuration:

---
security_tests:
  broken_function_level_authorization:
    skip: false

Reference¶

skip¶

Type : boolean

Skip the test if true.