Up to this point, most of the techniques and concerns we've talked about have dealt with the bad guys (or us) gaining access to information they should not have had. In the OWASP 2013 Top 10 (https://www.owasp.org/index.php/Top_10_2013-A4-Insecure_Direct_Object_References), this was known as Insecure Direct Object Reference (IDOR), and was number 4 on the list. There is another concern however, that used to exist as number 7 on the list, known as Missing Functional Access Level Control (https://www.owasp.org/index.php/Top_10_2013-A7-Missing_Function_Level_Access_Control), with its 2013 OWASP summary captured in the following screenshot. This category means to address the inadvertent or inappropriate disclosure of functions rather than information to the attacker.
In most cases,...
