The recently published “OWASP API security top 10” report analyzes the anti-patterns that lead to vulnerabilities and security risks in APIs. In this 10 part series, we introduce these API anti-patterns. Every API professional should know about these anti-patterns.


Broken Function-Level Authorization from the OWASP API security paper

API security anti-pattern for Broken Function-Level Authorization

If access control policies become too complex, for example by introducing many hierarchies, groups, and roles flaws in the authorization are more likely. Especially when there is no clear separation between administrative and regular functions. Attackers may exploit these issues to escalate their privileges, to gain access to the resources of other users, or to administrative functions.

Want to learn more?

Check out the complete OWASP API security paper. To secure access to your APIs, learn more about the OAuth in the OAuth Book, or the OAuth Course. To provide and use identity data in apps and APIs, learn more about OpenID Connect in the OpenID Connect Book, or the OpenID Connect Course.

The 10 most critical API security risks – Part 5: Broken Function-Level Authorization

Also published on Medium.

Matthias Biehl

As API strategist, Matthias helps clients discover their opportunities for innovation with APIs & ecosystems and turn them into actionable digital strategies. Based on his experience in leading large-scale API initiatives in both business and technology roles, he shares best practices and provides both strategic and practical guidance. He has stayed a techie at heart and at some point, got a Ph.D. Matthias publishes a blog at api-university.com, is the author of several books on APIs, and regularly speaks at technology conferences.