Fix BFLA (Broken Function Level Authorization) in Spring Boot

BFLA (Broken Function Level Authorization) occurs when the server-side fails to enforce hierarchical access controls. Attackers exploit this by directly hitting administrative or sensitive endpoints that developers erroneously assumed were hidden by the UI. In Spring Boot, this usually manifests as exposed @RestController methods that lack explicit role-based or permission-based checks, allowing any authenticated user—or even unauthenticated ones—to execute privileged operations.

The Vulnerable Pattern

@RestController
@RequestMapping("/api/v1/management")
public class AdminController {
@Autowired
private UserService userService;

// VULNERABLE: No authorization check. 
// Any user with a valid JWT/Session can delete any user.
@DeleteMapping("/users/{id}")
public ResponseEntity<Void> deleteUser(@PathVariable Long id) {
    userService.deleteUserById(id);
    return ResponseEntity.ok().build();
}
}

The Secure Implementation

To kill BFLA, stop relying on 'security by obscurity' and UI-side restrictions. 1. Enable `@EnableMethodSecurity` in your configuration. 2. Implement the Principle of Least Privilege by tagging every sensitive endpoint with `@PreAuthorize`, `@PostAuthorize`, or `@Secured`. 3. For complex logic, use SpEL (Spring Expression Language) to verify if the authenticated user owns the resource or has a specific permission (e.g., `hasPermission`). 4. Ensure your `SecurityFilterChain` is configured with a 'deny-all' fallback to catch any endpoints you forgot to protect.

@Configuration
@EnableMethodSecurity
public class SecurityConfig {}
@RestController
@RequestMapping(“/api/v1/management”)
public class AdminController {
@Autowired
private UserService userService;

// SECURE: Enforces 'ADMIN' role at the method level.
// Rejects requests with 403 Forbidden if the authority is missing.
@DeleteMapping("/users/{id}")
@PreAuthorize("hasRole('ADMIN')")
public ResponseEntity<Void> deleteUser(@PathVariable Long id) {
    userService.deleteUserById(id);
    return ResponseEntity.ok().build();
}
}