Fix BFLA (Broken Function Level Authorization) in Tornado

BFLA (Broken Function Level Authorization) is the silent killer of API security. It occurs when your application assumes that hiding a function or relying on basic authentication is enough. In Tornado, developers often slap `@tornado.web.authenticated` on a handler and call it a day, failing to verify if the authenticated user actually has the 'admin' or 'manager' scope required for the specific HTTP method. If a regular user can POST to an endpoint intended for admins just by guessing the URL, your authorization logic is dead on arrival.

The Vulnerable Pattern

class UserManagementHandler(BaseHandler):
    @tornado.web.authenticated
    def delete(self, user_id):
        # VULNERABILITY: Any logged-in user can delete any other user.
        # The @authenticated decorator only checks if self.current_user exists.
        db.execute("DELETE FROM users WHERE id = %s", (user_id,))
        self.write({"status": "success"})

The Secure Implementation

To kill BFLA in Tornado, you must implement a custom authorization decorator that wraps your request handlers. The vulnerable example fails because it confuses identity (Authentication) with permission (Authorization). By creating a `require_role` decorator, we intercept the request before it hits the logic layer. It checks the `current_user` object—populated from a secure cookie or JWT—and verifies the 'role' claim. If the user isn't an admin, we drop a 403 Forbidden. This ensures that sensitive functions are locked down to specific privilege levels, regardless of whether the endpoint is 'hidden' or not.

import functools
from tornado.web import HTTPError
def require_role(role):
def decorator(method):
@functools.wraps(method)
def wrapper(self, *args, **kwargs):
if not self.current_user or self.current_user.get(‘role’) != role:
raise HTTPError(403, reason=“Insufficient permissions”)
return method(self, *args, **kwargs)
return wrapper
return decorator
class UserManagementHandler(BaseHandler):
@tornado.web.authenticated
@require_role(‘admin’)
def delete(self, user_id):
# SECURE: Explicitly checks if the authenticated user has the ‘admin’ role.
db.execute(“DELETE FROM users WHERE id = %s”, (user_id,))
self.set_status(204)
self.finish()