Changing an API request from GET to PUT, PATCH, or DELETE can reveal broken function-level authorization (BFLA), but it is only one test technique—not proof that every pentest misses the flaw. OWASP’s current Web Security Testing Guide explicitly tells testers to try alternative HTTP methods, compare the responses, and verify whether the protected operation actually occurred. A complete assessment also tests role-specific endpoints, guessed administrative functions, and object-level permissions.
What BFLA means in an API
Broken Function Level Authorization occurs when a caller with a lower-privilege role can invoke a function reserved for a higher-privilege role. The request may be syntactically valid, authenticated, and aimed at a real resource; the failure is that the server does not consistently enforce who is allowed to perform that operation. OWASP describes the problem in terms of a user performing sensitive actions they should not have access to by changing how the request is made, including changing its HTTP method. See OWASP API5:2019 Broken Function Level Authorization.
As an Amazon Associate I earn from qualifying purchases.
For example, an ordinary account might be allowed to retrieve a profile with GET /users/123, while only an administrator should be able to disable that account with DELETE /users/123 or change its role with PATCH /users/123/role. If the application authenticates the caller but checks only that the endpoint exists, the same ordinary account may reach a privileged function.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →BFLA is about authorization for the function or operation. It can affect REST endpoints, RPC-style APIs, and GraphQL operations. It is not established merely because a request receives an unusual status code, an Allow header, or a different error message; the tester must determine whether the sensitive action was accepted and whether it changed application state.
#1 Best Overall
Why a “wrong HTTP method” test exposes an authorization gap
API documentation often presents one method per resource: GET for reading, POST for creating, PUT or PATCH for updating, and DELETE for removal. Implementations may route those methods through different controllers or middleware, however. A developer can protect the documented GET path while forgetting to apply the same role check to a PUT, PATCH, or DELETE handler.
OWASP’s BFLA guidance therefore recommends trying alternate methods against resources that are normally documented for GET or POST. A lower-privilege account replaying the request with another verb can expose an inconsistent policy. The result is a clue that the authorization boundary is attached to a route or controller incompletely, not a guarantee that the attacker can perform the action.
The method change is also useful when the URL gives no obvious indication that a function is administrative. OWASP’s API5:2023 guidance warns: “Don’t assume that an API endpoint is regular or administrative only based on the URL path.” A path such as /users, /settings, or /reports can contain both ordinary and privileged operations, so the verb and request body may determine which business function runs. Read the complete recommendation at OWASP API5:2023 Broken Function Level Authorization.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Scan for outdated or missing drivers - takes under a minute3Clear out junk files and repair common Windows errorsHow to test BFLA with different HTTP methods
1. Establish scope and the role model
Perform these requests only against systems and accounts you are authorized to test. Before sending traffic, document the application’s roles, groups, tenant boundaries, and hierarchy. Obtain credentials for at least one ordinary user and, where the engagement permits it, a higher-privilege account for comparison. Record which functions the owner says each role should be able to invoke.
Map the API resources and the requests that exercise them. Include routes discovered from an OpenAPI description, mobile or web client traffic, source review, and normal user workflows. Do not classify a function as safe or administrative solely from its path; identify the business action behind each request.
2. Capture a permitted baseline
With the lower-privilege identity, send the documented request exactly as the client does. Preserve the method, path, query string, headers, body, and authentication context. Save the response status, headers, body, and any observable state such as a record, role, report, or job created by the request.
Repeat the same operation with the higher-privilege identity when possible. The comparison helps separate a genuine authorization decision from a malformed request, missing feature, or tenant restriction. A 403 for both accounts does not show that the policy is correct, and a 200 for both accounts does not show that the sensitive effect occurred.
Free tools Windows power users keep installed
One-click scans. No signup required.
3. Replay the request with alternative verbs
Change one meaningful variable at a time. Keep the path and authentication context constant, then test the methods that make sense for the resource. OWASP’s current WSTG BFLA scenario specifically calls for testing various HTTP methods for BFLA vulnerabilities and names PUT, DELETE, and PATCH as alternatives to endpoints normally documented for GET or POST. Its guidance is available at WSTG API Broken Function Level Authorization.
| Baseline request | Alternative probe | What to establish |
|---|---|---|
| GET on a resource | PUT, PATCH, or DELETE on the same resource, with a valid body where required | Whether the lower-privilege role can reach an update or destructive function |
| POST for an ordinary workflow | PUT, PATCH, or DELETE where the API’s design supports those operations | Whether a different handler applies weaker role checks |
| Any documented endpoint | The same request under each authorized test identity | Whether the authorization outcome changes appropriately with role |
Do not send destructive requests indiscriminately. Use a test tenant, disposable record, dry-run option, or an agreed rollback procedure. If a DELETE request could remove production data, the correct action may be to stop after a non-destructive authorization check and report the limitation.
4. Compare behavior, not just status codes
Record status codes, response bodies, redirects, timing, and headers, but treat them as evidence to interpret. A 200 or 202 can indicate that the server accepted the operation, yet the action may be queued, ignored, or later rejected. A 403 or 405 can indicate denial, but a proxy, gateway, or custom error handler may have generated it before the application evaluated the function.
Check the operation-specific result: did a role change appear in the database, did a record’s state change, was a report generated, or did an administrative job start? Use a second authorized account or an out-of-band audit log when the application does not expose the result directly. OWASP’s WSTG method-testing guidance emphasizes enumerating methods and verifying responses with actual requests rather than inferring authorization from documentation. See WSTG Test HTTP Methods.
5. Test functions beyond verb changes
A method matrix is only one part of BFLA testing. With the low-privilege account, try role-specific or guessed endpoints that the client does not normally expose, such as administrative reporting, user management, export, approval, or configuration functions. Use paths found in authorized documentation and traffic analysis; do not rely on the presence of words such as admin or manage as proof that access is protected.
Check alternate versions and route forms when they are in scope, such as a versioned API path or a mobile-only endpoint. Look for function aliases, bulk operations, asynchronous job endpoints, and GraphQL mutations. The current WSTG BFLA material includes GraphQL because authorization must be enforced at the resolver or business-function level, not assumed from a URL that GraphQL may not have.
Is changing GET to DELETE enough to prove a vulnerability?
No. A GET-to-DELETE change is a probe, not a finding by itself. It becomes a BFLA finding only when the evidence shows that a lower-privilege identity can invoke a function it should not be allowed to invoke, and the operation is attributable to that request.
- Method not supported: The server may correctly return 405 Method Not Allowed because the resource has no DELETE implementation.
- Gateway interference: A reverse proxy or Web Application Firewall may reject the verb before the application’s authorization code runs.
- Input failure: The handler may be reached but reject the body, content type, state transition, or identifier before performing the function.
- Asynchronous processing: A 202 response may queue work whose authorization decision appears only in a later job status or audit event.
- Safe test environment: A test tenant may intentionally suppress side effects, so the absence of a change does not automatically prove denial.
Confirm the result with an authorized observation point and compare it with the higher-privilege baseline. If you cannot verify the effect, report the behavior as an authorization test requiring confirmation rather than claiming a successful exploit.
Recommended Free Tools
Use OPTIONS and method enumeration carefully
Enumerating supported methods can reveal the server’s advertised surface. OWASP says in its HTTP-method test that “The simplest way to do this is to make an OPTIONS request to the server.” An illustrative request is:
curl -i -X OPTIONS https://api.example.test/resourceThe response may include an Allow header, but that header is not an authorization decision. It can list methods available to the resource in general, not methods permitted to the current role. Follow enumeration with authenticated requests for each relevant method and verify the resulting function. Also test method-override mechanisms, such as a framework-specific header or parameter, only when they are documented or observed in the authorized application; an override can create a second path around a check.
Keep BFLA separate from BOLA
Broken Object Level Authorization (BOLA) asks whether the caller may access or alter the particular object named in a request. BFLA asks whether the caller’s role may invoke the function at all. The same endpoint can have one problem, both, or neither.
| Question | BFLA test | BOLA test |
|---|---|---|
| Authorization target | Is this role allowed to perform the operation? | Is this caller allowed to access this specific object? |
| Typical variation | Keep the resource and identity context, vary the function or HTTP method | Keep the function, vary the object identifier, account, or tenant |
| Example | Can a regular user call an administrative approval mutation? | Can that user read or modify another customer’s invoice? |
Test both dimensions. A role check that blocks DELETE for ordinary users does not protect an allowed GET if users can substitute another tenant’s object ID, and an object-ownership check does not make an administrative function safe for every authenticated role. OWASP’s distinction is summarized in the REST Assessment Cheat Sheet.
Why a pentest can miss the issue
- Scope favors the happy path: The assessment may exercise documented user journeys but not enumerate alternate methods or hidden functions.
- Only one identity is supplied: Without accounts representing different roles, testers cannot compare authorization outcomes.
- URL-based assumptions: Reviewers may inspect
/adminroutes and overlook privileged operations under ordinary-looking paths. - Automation stops at HTTP status: A scanner can flag a 200 response without checking whether a state transition actually happened, or miss a vulnerability hidden behind a 202 job.
- Safety constraints: Destructive methods may be excluded from production testing, leaving a documented limitation that must be addressed with a controlled environment or non-destructive proof.
- Changing API behavior: The WSTG “latest” page can evolve, so a test plan copied from an older version may omit newer scenarios.
These are possible engagement or implementation gaps, not evidence that all pentesters avoid wrong-method testing. OWASP explicitly recommends the check; the available guidance does not establish how often individual testers perform it or why a particular engagement omitted it.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.How to report a suspected BFLA finding
Make the report reproducible and precise. Include the endpoint, method, request body, authentication role, tenant or test-object identifiers, and the expected authorization rule. Show the baseline response and the alternate-method response, then document the observable side effect or audit evidence. State whether the operation was immediate, asynchronous, or blocked before business logic.
Rank #4
Describe impact in terms of the function exposed: account deletion, role modification, approval, export, configuration change, or another sensitive action. Avoid claiming broader access than the evidence demonstrates. If the request reached a handler but failed validation, classify it as an authorization-control observation or a lead for retesting rather than a confirmed BFLA exploit.
Record the exact identities used and the date, environment, API version, and safeguards in place. This lets the owner reproduce the result without confusing a staging-only behavior with production exposure.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
How developers prevent BFLA
Authorization should be enforced for each business function at the server, with a default-deny posture and explicit grants to roles or groups. Apply the same policy whether the function is reached through GET, POST, PUT, PATCH, DELETE, a method override, a bulk endpoint, or a GraphQL mutation. Do not rely on a URL prefix, controller name, client-side menu, or API documentation to provide the security boundary.
- Centralize policy decisions where practical, but pass the concrete function and resource context into the check.
- Require explicit role or group authorization for administrative operations, even when those operations share a controller or URL area with ordinary user actions.
- Return consistent denial behavior without leaking unnecessary implementation details, while still logging the decision for security monitoring.
- Write automated tests for every sensitive function using both permitted and denied roles, including alternate HTTP methods and method-override paths that the framework supports.
- Verify authorization at the point where the state change occurs, not only at an outer route or gateway.
Use a test matrix that pairs each function with identities, methods, object ownership, and expected effects. Re-run it when routes, frameworks, API versions, or role definitions change.
Which OWASP guidance should you use?
For a reproducible baseline, OWASP’s project page lists Web Security Testing Guide v4.2 as the latest stable release and says v5.0 is under development. The “latest” BFLA page contains current guidance and may change over time, so cite the page version or access date in a formal engagement. The project page also says the guide is freely available and notes a printed book for the older v4 edition; the print reference is not a substitute for checking the current online material. See OWASP Web Security Testing Guide project page.
The practical takeaway is straightforward: include alternate-method probes in every authorized BFLA assessment, but treat them as part of a broader function-authorization and state-verification process. A lower-privilege account changing GET to DELETE may reveal a serious gap; only a demonstrated unauthorized function execution makes the finding conclusive.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
