domains / families / security / hunt-broken-function-level-auth

hunt-broken-function-level-auth

separate

Hunt broken function-level authorization via verb drift, route shadowing, and transport gaps.

When to use

• API has distinct user roles (admin, moderator, user) but role checks are per-controller, not per-method.
• Legacy or deprecated endpoints still served behind updated middleware.
• GraphQL, gRPC, and WebSocket transports exist alongside REST APIs without authorization parity.
• Feature flags or beta endpoints expose functionality before security review.
• Batch/job endpoints accept internal requests without role verification.

When not to use

• object-level authorization (IDOR)
• public user-info endpoints
• consumer-facing mutations that are IDOR

Skill page

Source