Broken Access Control & Authentication Failures¶

Broken Access Control is consistently the #1 web risk on the OWASP Top 10. It's about users doing things they shouldn't be allowed to do.

What Access Control Failures Look Like¶

Insecure Direct Object Reference (IDOR)¶

GET /api/invoices/1001 ← your invoice GET /api/invoices/1002 ← someone else's — and the server returns it!

The app checks that you're logged in but not that the object belongs to you. Always verify authorization on every request, server-side, scoped to the current user.

Missing Function-Level Authorization¶

A regular user calls an admin-only endpoint (POST /api/admin/deleteUser) directly. The UI hid the button, but the API didn't enforce the role. The server must enforce authorization — never rely on a hidden UI.

Privilege Escalation¶

• Horizontal: accessing another user's data at the same privilege level (IDOR).
• Vertical: gaining higher privileges (user → admin).

Defenses for Access Control¶

1. 1.Deny by default — every resource requires explicit authorization.
2. 2.Enforce server-side on every endpoint, checking this user may access this resource.
3. 3.Use centralized authorization logic, not scattered ad-hoc checks.
4. 4.Apply RBAC/ABAC consistently (see Chapter 6).
5. 5.Log access-control failures and alert on spikes.

Authentication Failures¶

Weak authentication lets attackers become legitimate users.

Session Management Essentials¶

• Set cookies HttpOnly, Secure, SameSite.
• Generate session IDs with a CSPRNG.
• Rotate the session ID on login (prevents session fixation).
• Invalidate sessions server-side on logout and after inactivity.

Multi-Factor Authentication (MFA)¶

MFA combines factors from different categories:

MFA stops the vast majority of account-takeover attacks even when passwords leak. Prefer phishing-resistant factors (FIDO2/WebAuthn hardware keys) over SMS, which is vulnerable to SIM-swapping.