1. Executive Summary & Scope
Missing Function Level Access Control occurs when web applications fail to verify that a user possesses authorization before invoking a sensitive backend action or API method. Often developers secure the main page view but leave the underlying API endpoints, AJAX webhooks, or file export methods exposed.
Standard Classification
OWASP Standard: OWASP Top 10 • Mapping: CWE-862 • Target Architecture: Public Web Systems & APIs
2. Threat Model & Attack Vectors
Attackers discover hidden API routes through client-side JavaScript bundle inspection and execute privileged exports, database maintenance operations, or user resets without logging in.
3. Code Analysis & Remediation Playbook
Vulnerable Implementation Pattern
// VULNERABLE: Public route dispatch without middleware protection
$router->post('/api/export/audit-logs', function() {
// Generates complete enterprise audit logs without authentication
return exportEnterpriseAuditLogs();
});
Hardened Defense-in-Depth Implementation
// REMEDIATED: Route-level middleware assertion
$router->post('/api/export/audit-logs', [
Middleware\Authenticate::class,
Middleware\RequirePermission::with('audit:export'),
function() {
return exportEnterpriseAuditLogs();
}
]);
4. Audit Verification Checklist & Pass Criteria
| Verification Phase | Audit Test Description | Mandatory Passing Criteria |
|---|---|---|
| Anonymous Endpoint Fuzzing | Send unauthenticated POST/PUT/DELETE requests to all discovered API endpoints. | Server returns 401 Unauthorized or 403 Forbidden on 100% of endpoints. |
| HTTP Method Tampering | Switch POST to GET or HEAD to bypass improperly defined verb filters in web server configs. | Authorization policy applies universally regardless of HTTP method. |
| GraphQL Field Authorization | Query restricted fields and mutations in GraphQL schemas without proper scopes. | GraphQL resolver denies execution with granular authorization errors. |
Advertisement
WE
WebOTG Application Security Directorate
Senior Security Auditor
WebOTG provides benchmark reference documentation, automated matrix evaluators, and security test harnesses for government digital platforms, WQMS architectures, and STQC compliance frameworks.