A business flow is the sequence of application steps that completes a real-world task, such as creating an account, booking a reservation, canceling a ticket, or changing a payment method. Unlike a single API call, it includes the expected order, state changes, and rules that make the task valid.
In cyber security, business flows matter because attackers often target the workflow, not just the login. If a server trusts the client too much, an attacker can skip steps, repeat actions, change identifiers, or trigger an action outside the allowed state. Defenses include server-side authorization on every step, strict state validation, least privilege, rate limiting, and testing for out-of-order or cross-user requests. Strong business-flow controls help prevent unauthorized bookings, cancellations, fraud, and other integrity attacks.