04.6.2 · Skill in Security and privacy engineering

Authorization

Controlling what each user is allowed to see and do.

Authorization decides access to data and actions, through roles, permissions or ownership rules. Broken access control is one of the most common serious vulnerabilities. Checks belong on the server, close to the data.

Your status · Authorization

Not startedLearningComfortable

Saved in this browser only. It colours this skill's tile on your map.

Resources

docsGo deeper
Authorization cheat sheet ↗
OWASP · 20 min
Deny by default, check on the server, on every request. The rules that prevent broken access control.

Tools

none yet

Tools for this topic are being researched.