A Detailed Guide to the OWASP Top 10 - API5:2023 Broken Function Level Authorization

The video discusses the importance of authorization in APIs, focusing on a specific vulnerability that arises when group-based permissions are not enforced correctly. It provides a scenario where an attacker can exploit this vulnerability by changing API requests, leading to unauthorized access. The video then outlines preventive measures, such as denying all access by default and reviewing API endpoints for authorization flaws, to protect systems from such vulnerabilities.

What is the main issue when group-based permissions are not enforced correctly?

• Unauthorized users may gain access to restricted resources.

• Permissions are assigned manually to each user.

• Users cannot access any resources.

• All users have the same level of access.

In the given example, what change does the attacker make to the API request to exploit the vulnerability?

• They change a POST request to a GET request.

• They encrypt the request data.

• They change a GET request to a POST request.

• They add additional headers to the request.

What is the primary goal of the attacker in the example provided?

• To access user emails.

• To delete user accounts.

• To gain admin privileges.

• To modify the application code.

Which of the following is a recommended preventive measure against the described vulnerability?

• Using the same password for all admin accounts.

• Implementing function level authorization checks.

• Disabling all API endpoints.

• Allowing all users to access admin functions.

Why is it important for admin controllers to inherit from an administrative abstract controller?

• To simplify the code structure.

• To allow users to bypass security checks.

• To improve application performance.

• To ensure consistent authorization checks.