Missing Function Level Access Control
Missing function-level access control is the server failing to perform authorization checks on specific functions/endpoints, relying only on hiding front-end menus.
Purpose
To understand that front-end hiding is not security and server-side authorization is required; a common access-control defect.
Mechanism
The front end hides the admin menu, but the server-side /api/admin lacks an authorization check, so attackers call the endpoint directly to perform admin operations. Defenses: server-side authorization checks on every endpoint, central middleware.
Use cases
- Function-level authorization audit
- Server-side access control
- Endpoint protection