OWASP API5:2023 · CWE-285 · Function-Level RBAC Hunter
Broken Function Level Authorization (BFLA) HTTP Verb Matrix
Audits administrative and privileged routes across GET, POST, PUT, and DELETE verbs using low-privilege member tokens.
| Route Pattern | GET (Member Token) | POST (Member Token) | PUT (Member Token) | DELETE (Member Token) | Static + Runtime Assessment |
|---|---|---|---|---|---|
| /api/v2/admin/users | 200 OK (JWT alg:none) | 403 Forbidden | 403 Forbidden | 403 Forbidden | API-002: Accepts unsigned alg:none JWT on GET |
| /api/v2/admin/users/{id} | 200 OK (Leaks Hash) | 405 | 403 Forbidden | 403 Forbidden | API-005: Serializes bcrypt password_hash in DTO |
| /api/v2/users/{id} | 200 OK (BOLA) | 405 | 200 OK (Escalates is_admin) | 403 Forbidden | API-006: PUT allows member to set role='admin' |
| /api/v2/admin/audit-logs | 403 Forbidden | 403 Forbidden | 405 | 403 Forbidden | Verified: @require_role('ADMIN') enforced across all verbs |