API5 BFLA: Automated Authorization Tests from the Endpoint Inventory and Separating Admin APIs
You close BFLA for good with tests that list the endpoints the application really exposes through EndpointDataSource and verify that each one carries an explicit authorization decision and has rows in the matrix. We separate the admin surface with a route group, a policy and its own port, show that RequireHost can be bypassed with the Host header and add a real port check, and handle per-method permissions and method override headers.
8 Nov 2026
·
11 min
·
11
