> For the complete documentation index, see [llms.txt](https://docs.pynt.io/documentation/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.pynt.io/documentation/api-security-testing/pynt-security-tests-coverage/business-logic-tests.md).

# Business Logic Tests

{% hint style="danger" %}
**At a Glance**: ⚠️ Business logic API attacks exploit weaknesses in the underlying logic of an API to gain unauthorized access or manipulate data. Developers must understand these issues to prevent security breaches.
{% endhint %}

***

## What are the common mistakes made by developers?

In most cases Business logic issues happen when authorization is not enforced through all the flows of the application. Modern applications usually assign a non guessable identifiers to users and resources. 

Consider the following example:

```python
def get_profile(self, getprofile_request, context):
    cursor, conn = connection_to_sql(f"GET_PROFILE_BL {getprofile_request}")
    cursor.execute('select * from profiles where uid=?',(getprofile_request.uid,))
    p = cursor.fetchone()
```

The function get\_profile accepts the User ID as uid and directly querying the database to get this user's profile without any validation that the logged in user is the same user that is represented by the uid.

## How can I fix Business Logic issues?

Ensure that only authorized users can access the API and that access is granted on a need-to-know basis. Use strong authentication methods such as multi-factor authentication and implement authorization checks at the API endpoint level. 

## Test cases in this category

These test cases test the enforce of authorization between user identifiers, resource identifiers and the actual logged in users on APIs that **read** user related data

<table><thead><tr><th>Test case</th><th width="226.33333333333331">OWASP</th><th>CWE</th><th data-hidden></th></tr></thead><tbody><tr><td><strong>[BL001]</strong> User data leakage to other users - Resource-ID authorization</td><td><a href="https://github.com/OWASP/API-Security/blob/master/2019/en/src/0xa1-broken-object-level-authorization.md">API1 OWASP API Top 10</a></td><td><a href="https://cwe.mitre.org/data/definitions/285.html">CWE-285</a>, <a href="https://cwe.mitre.org/data/definitions/284.html">CWE-284</a>, <a href="https://cwe.mitre.org/data/definitions/639.html">CWE-639</a></td><td></td></tr><tr><td><strong>[BL002]</strong> User data leakage to other users - User-ID authorization</td><td><a href="https://github.com/OWASP/API-Security/blob/master/2019/en/src/0xa1-broken-object-level-authorization.md">API1 OWASP API Top 10</a></td><td><a href="https://cwe.mitre.org/data/definitions/285.html">CWE-285</a>, <a href="https://cwe.mitre.org/data/definitions/284.html">CWE-284</a>, <a href="https://cwe.mitre.org/data/definitions/639.html">CWE-639</a></td><td></td></tr><tr><td><strong>[BL003]</strong> User data leakage to other users - Resource-ID and User-ID authorization</td><td><a href="https://github.com/OWASP/API-Security/blob/master/2019/en/src/0xa1-broken-object-level-authorization.md">API1 OWASP API Top 10</a></td><td><a href="https://cwe.mitre.org/data/definitions/285.html">CWE-285</a>, <a href="https://cwe.mitre.org/data/definitions/284.html">CWE-284</a>, <a href="https://cwe.mitre.org/data/definitions/639.html">CWE-639</a></td><td></td></tr><tr><td><strong>[BL004]</strong> User data leakage to other users - credentials authorization</td><td><a href="https://github.com/OWASP/API-Security/blob/master/2019/en/src/0xa1-broken-object-level-authorization.md">API1 OWASP API Top 10</a></td><td><a href="https://cwe.mitre.org/data/definitions/285.html">CWE-285</a>, <a href="https://cwe.mitre.org/data/definitions/284.html">CWE-284</a>, <a href="https://cwe.mitre.org/data/definitions/639.html">CWE-639</a></td><td></td></tr></tbody></table>

These test cases test the enforce of authorization between user identifiers, resource identifiers and the actual logged in users on APIs that **write** user related data

| Test case                                                                                  | OWASP                                                                                                                          | CWE                                                        |
| ------------------------------------------------------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------ | ---------------------------------------------------------- |
| **\[BL005]** User data manipulation by other users - Resource-ID authorization             | [API5 OWASP Top 10](https://github.com/OWASP/API-Security/blob/master/2019/en/src/0xa5-broken-function-level-authorization.md) | [CWE-285](https://cwe.mitre.org/data/definitions/285.html) |
| **\[BL006]** User data manipulation by other users - User-ID authorization                 | [API5 OWASP Top 10](https://github.com/OWASP/API-Security/blob/master/2019/en/src/0xa5-broken-function-level-authorization.md) | [CWE-285](https://cwe.mitre.org/data/definitions/285.html) |
| **\[BL007]** User data manipulation by other users - Resource-ID and User-ID authorization | [API5 OWASP Top 10](https://github.com/OWASP/API-Security/blob/master/2019/en/src/0xa5-broken-function-level-authorization.md) | [CWE-285](https://cwe.mitre.org/data/definitions/285.html) |
| **\[BL008]** User data manipulation by other users - credentials authorization             | [API5 OWASP Top 10](https://github.com/OWASP/API-Security/blob/master/2019/en/src/0xa5-broken-function-level-authorization.md) | [CWE-285](https://cwe.mitre.org/data/definitions/285.html) |

This test case try to guess values of user Identifiers with a numeric structure

| Test case                                  | OWASP                                                                                                                          | CWE |
| ------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------ | --- |
| **\[BL009]** Guessable resource identifier | [API1 OWASP Top 10](https://github.com/OWASP/API-Security/blob/master/2019/en/src/0xa5-broken-function-level-authorization.md) |     |


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.pynt.io/documentation/api-security-testing/pynt-security-tests-coverage/business-logic-tests.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.