Broken access control is the most common class of web application vulnerability in production today, and it sits at the top of the OWASP Top 10 as A01:2021 - Broken Access Control.
In this lesson you will:
- Recognize a vertical privilege issue by attempting to reach the administration page as a normal customer.
- Recognize a horizontal privilege issue and an insecure direct object reference (IDOR) — also called BOLA (Broken Object Level Authorization) in the OWASP API Security Top 10 — by examining how baskets are identified.
- Recognize a server-side authorization failure by inspecting how the customer feedback form attributes an author to a record.
Estimated time: 10 to 15 minutes.
Prerequisite: register a normal user account in NovaCart and log in. You do not need administrative privileges for this lesson, and you should not have them.
Course position: this is the canonical authorization lesson. Later API, GraphQL, WebSocket, mass-assignment, and account-recovery lessons reuse the same rule: the server must authorize every action and object against the authenticated session.
When you are ready, send the Continue signal.