What is API Authorization Testing and How to Do It Right?

APIs are essential for driving distributed computing, microservices, and low-latency operations across enterprises.

However, they also introduce significant security risks.

In fact, 29% of all web-based attacks now target APIs, with Weak or Broken Authorization responsible for over 60% of the top breaches last year.

This blog delves into API Authorization—exploring its fundamentals and testing methodologies to help you safeguard your APIs.

‍

What is API Authorization?

API Authorization determines the specific access levels and permissions an authenticated user has to an API's resources and functionalities.

It ensures that only authorized users can perform sensitive operations or access critical data.

However, strong authorization cannot be achieved without strong authentication.

As authentication confirms the user’s identity, serving as the foundation for accurate authorization. Without reliable authentication, even advanced authorization strategies, like those using OAuth and JWT, can falter if the initial identity verification is flawed.

‍

Why test APIs for Authorization Vulnerabilities?

Unlike the recent adoption of Authentication Frameworks and tools across all Dev teams, API Authorization is still something every enterprise team solves independently.

Most teams rely on custom-built authorization systems, which are often prone to errors and misconfigurations. This complexity is heightened when managing multiple roles and permissions, leading to potential vulnerabilities.

While OAuth and JWTs can simplify implementation by defining scopes and securely signing tokens, they do not inherently address all authorization issues. Without proper management and configuration, these methods can still result in misconfigurations that lead to excessive privileges or unauthorized access.

Two major risks associated with faulty authorization:

Broken Object Level Authorization (BOLA)

This occurs when APIs fail to verify if a user is authorized to access a specific object, leading to unauthorized data exposure and potential system compromise. BOLA is a top concern in the OWASP API Top 10 due to its prevalence and impact on over 40% of the most public breaches last year.
Broken Function Level Authorization (BFLA)

Allows regular users to perform tasks reserved for administrators due to inadequate permission checks at the function level. Although less common than BOLA, BFLA can still result in significant security breaches if exploited.

Testing Methodologies for API Authorization

Now that we’ve established that testing to find such Authorization vulnerabilities is important, how can your DevSecOps team effectively test for these vulnerabilities? Let’s break it down.

Role-Based Access Control (RBAC)

You’re probably familiar with Role-Based Access Control (RBAC)—it’s a tried-and-true method for managing who gets access to what within your systems. By grouping users and assigning permissions at the group level, RBAC makes it easier to control access. But here’s the thing: as users move between groups or change roles, permissions should adjust accordingly. To test if they do, create user groups and assign permissions at the group level. Then verify that a user is part of a specific group and ensure they inherit the correct permissions associated with that group. But don’t stop there. Testing should also account for scenarios where users belong to multiple groups or are removed from a group, ensuring that their permissions are updated accordingly.
Horizontal Authorization Bypass Testing

Consider a scenario where two of your customers log into your platform and have identical access levels. Both are a part of the same platform, but each user's profile and personal data should remain private and inaccessible to the other. Horizontal authorization testing ensures that users cannot access each other's private information even though they share similar permissions. This is vital for protecting the privacy of your customers and maintaining the security of their sensitive data.
Vertical Authorization Bypass Testing

Now, vertical authorization testing is all about preventing privilege escalation. Your team needs to ensure that lower-privileged users can’t somehow gain access to resources meant for higher-level roles like admins. For example, a general employee should never be able to view sensitive executive files. By rigorously testing for this, you ensure that access hierarchies are respected, and your most sensitive information stays out of the wrong hands preventing a system takeover.
Object-Level Access Control (OLAC)

Object-Level Access Control (OLAC) goes a step further by focusing on access to individual objects—like specific documents or files. Let’s say you’re managing a project where only two people should have access to a particular resource. Even if others have higher roles, OLAC testing ensures that only those two individuals can view and access that resource. This level of control is crucial in environments where confidentiality is non-negotiable, like in legal, financial, or healthcare sectors.

Testing for all these permissions becomes particularly challenging in multitenant SaaS environments, where multiple users share the same database but should only access their own data. When dealing with multiple modules and microservices, this complexity is magnified, where even a small implementation error can lead to significant security breaches.

That’s why continuous, detailed testing, supplemented by robust API visibility, should be a cornerstone of your security strategy. As APIs evolve, older versions are deprecated, and shadow APIs emerge, any overlooked endpoint with broken authorization can quickly become a breach point. By maintaining comprehensive API inventories and tracking all endpoints, your team can stay ahead of potential threats.

‍

How to identify API Authorization Vulnerabilities?

Now that we’re clear on the types of vulnerabilities to test, let’s explore how to identify them.

To identify vulnerabilities, manual testing tools like Postman can be effective. For instance, logging in as one user in one tab and another user in a separate tab allows you to test whether one user’s token can access another’s data. Similarly, attempting to access an object ID belonging to one user with the credentials of another can reveal BOLA vulnerabilities.

Given the vast expanse of enterprise networks, manually testing all APIs across different environments becomes increasingly cumbersome and prone to oversights. The sheer volume of permutations and combinations makes it almost impossible to cover every scenario thoroughly.

While SAST and DAST tools offer some solutions, they often fall short in detecting complex authorization vulnerabilities due to their limitations in analyzing runtime interactions and business logic.

SAST tools analyze the source code but lack the context of runtime interactions and business logic, rendering them ineffective at identifying complex authorization issues. On the other hand, DAST tools test applications in their running state but struggle with dynamic interactions and complex authorization flows, missing intricate bugs that occur during client-API communication.

To address these limitations, IAST can be used. However, it still cannot guarantee complete coverage due to the complex nature of authorization logic.

‍

Automate API Authorization Testing with Levo.ai

Levo revolutionizes API authorization testing with a streamlined, automated approach that outperforms traditional methods.

Unlike legacy tools, Levo provides comprehensive visibility into your entire API ecosystem including authorization roles and scopes.

As a part of our API Discovery module, we analyze traffic and map JWTs to create a detailed inventory of permissions, even when documentation is sparse or fragmented. This visibility allows for precise role validation and refinement, ensuring that all relevant roles and permissions are accurately captured.

Once roles are confirmed, Levo automates the testing of various authorization scenarios—horizontal and vertical access controls, object-level permissions, and advanced BOLA cases. Our system efficiently manages testing across thousands of endpoints and numerous OAuth scopes, a feat that is impossible to perform manually.

Levo easily detects all authorization-related vulnerabilities such as insufficient token validation, improper scope handling, insecure direct object references (IDOR), and over-permissive roles. We also reproduce the payload code that detected the said vulnerability and map it to the concerned API and developer to accelerate remediation.

Book a demo using this link to see this live in action!