The missing function-level access control vulnerability refers to the flaws in the authorization logic. By exploiting it, an attacker, who could be an existing user of the application, is able to escalate privileges and access restricted functionalities. For example, the restricted administrator-level features are often a target for this attack.
Attackers exploit this vulnerability primarily by manipulating URLs. For example, consider these URLs provided by an application:
Although both require authenticated users, let’s assume that the /remove endpoint should be available only to the admin user. If an unauthenticated or an authenticated nonadmin user could access the /remove endpoint, this is a missing function-level access control flaw.
The first step toward preventing access-control issues is to define the access-control policy for the application. The access-control policy describes security requirements for each functionality so that developers can implement it in a consistent manner.
In its simplest form, the Node applications can implement access control by using middleware in a route configuration. The middleware function acts as a filter that allows you to modify the request object, write to response, invoke next middleware, or end the request without continuing the chain. We can add a number of middleware ...