Fix BFLA (Broken Function Level Authorization) in Yii

Broken Function Level Authorization (BFLA) in Yii frameworks typically manifests when developers rely on simple authentication checks rather than granular authorization. Attackers exploit this by directly hitting administrative endpoints (e.g., /user/delete?id=1) that lack proper AccessControl filter (ACF) or RBAC enforcement. In a hacker's eyes, an 'authenticated' status is just the first door; BFLA is the unlocked safe inside.

The Vulnerable Pattern

class UserController extends \yii\web\Controller {
    public function actionDelete($id) {
        // VULNERABILITY: No AccessControl behavior defined.
        // Any user, even a guest or low-privilege account, can trigger this.
        $this->findModel($id)->delete();
        return $this->redirect(['index']);
    }
}

The Secure Implementation

To kill BFLA, you must implement the `behaviors()` method using `yii\filters\AccessControl`. The 'vulnerable' snippet fails because it lacks a filter, leaving every public function exposed. The 'secure' snippet enforces a strict whitelist: only users assigned the 'admin' role via Yii's RBAC component can access the 'delete' action. For complex logic, we combine ACF with `Yii::$app->user->can()`, which checks specific permissions and optional business rules (e.g., ensuring a user can only delete their own data), effectively closing both BFLA and IDOR vectors.

use yii\filters\AccessControl;
class UserController extends \yii\web\Controller {
public function behaviors() {
return [
‘access’ => [
‘class’ => AccessControl::class,
‘rules’ => [
[
‘actions’ => [‘delete’],
‘allow’ => true,
‘roles’ => [‘admin’], // Only users with ‘admin’ role
],
],
‘denyCallback’ => function ($rule, $action) {
throw new \yii\web\ForbiddenHttpException(‘Insufficient permissions.’);
}
],
];
}
public function actionDelete($id) {
    $model = $this->findModel($id);
    // Additional check for object-level ownership if necessary
    if (\Yii::$app->user->can('deleteOwnPost', ['post' => $model])) {
         $model->delete();
    }
    return $this->redirect(['index']);
}
}