Securing Node Applications

Chapter 7. Missing Function-Level Access Control

The missing function-level access control vulnerability refers to the flaws in the authorization logic. By exploiting it, an attacker, who could be an existing user of the application, is able to escalate privileges and access restricted functionalities. For example, the restricted administrator-level features are often a target for this attack.

Attack Mechanics

Attackers exploit this vulnerability primarily by manipulating URLs. For example, consider these URLs provided by an application:

example.com/account/view

example.com/account/remove

Although both require authenticated users, let’s assume that the /remove endpoint should be available only to the admin user. If an unauthenticated or an authenticated nonadmin user could access the /remove endpoint, this is a missing function-level access control flaw.

Preventing Missing Function-Level Access Control

The first step toward preventing access-control issues is to define the access-control policy for the application. The access-control policy describes security requirements for each functionality so that developers can implement it in a consistent manner.

In its simplest form, the Node applications can implement access control by using middleware in a route configuration. The middleware function acts as a filter that allows you to modify the request object, write to response, invoke next middleware, or end the request without continuing the chain. We can add a number of middleware ...