API Testing · Middle · Question 22 of 75

What is broken function level authorization?

1An endpoint is slower for some user roles
2A normal user can call admin-only endpoints
3A function in the API returns the wrong type

Show the answer

Correct answer: A normal user can call admin-only endpoints

Explanation

Hiding admin buttons doesn't protect /admin/users. Testers call such endpoints with low-privilege tokens.

Further reading

OWASP API Security Top 10 (2023) ↗

Test yourself

Take the API Testing · Middle quiz: questions and options are shuffled, and you get a review of your mistakes at the end.