How to fix BFLA (Broken Function Level Authorization)
in Phoenix
Executive Summary
BFLA is the silent killer of Elixir/Phoenix apps. While IDOR targets specific data instances, BFLA targets functional logic—allowing low-privilege users to hit administrative or sensitive endpoints. If your controller actions rely solely on authentication without explicit functional authorization, you're leaving the door wide open for vertical privilege escalation.
The Vulnerable Pattern
defmodule MyAppWeb.UserController do use MyAppWeb, :controllerVULNERABLE: Any authenticated user can call this to delete any other user.
It checks if the user exists, but not if the requester has the ‘admin’ role.
def delete(conn, %{“id” => id}) do user = Accounts.get_user!(id) {:ok, _user} = Accounts.delete_user(user) send_resp(conn, :no_content, "") end end
The Secure Implementation
The vulnerability stems from treating 'Authenticated' as 'Authorized'. To fix BFLA in Phoenix, you must implement a layer of Functional Authorization. This is best achieved using Plugs or Policy modules (like Bodyguard or Canary). The secure example uses a private plug to intercept the request pipeline, verifying the 'role' attribute of the 'current_user' before allowing access to the 'delete' function. Always 'halt()' the connection on failure to prevent the controller action from executing.
defmodule MyAppWeb.UserController do use MyAppWeb, :controllerSECURE: Enforce authorization via a Plug before the action executes.
plug :ensure_admin_role when action in [:delete]
def delete(conn, %{“id” => id}) do user = Accounts.get_user!(id) {:ok, _user} = Accounts.delete_user(user) send_resp(conn, :no_content, "") end
defp ensure_admin_role(conn, _opts) do case conn.assigns.current_user.role do “admin” -> conn _ -> conn |> put_status(:forbidden) |> json(%{error: “Insufficient permissions to perform this function”}) |> halt() end end end
Your Phoenix API
might be exposed to BFLA (Broken Function Level Authorization)
74% of Phoenix apps fail this check. Hackers use automated scanners to find this specific flaw. Check your codebase before they do.
Free Tier • No Credit Card • Instant Report
Verified by Ghost Labs Security Team
This content is continuously validated by our automated security engine and reviewed by our research team. Ghost Labs analyzes over 500+ vulnerability patterns across 40+ frameworks to provide up-to-date remediation strategies.