What a user may do.
WHAT THE COMMONEST SERIOUS FAULT IS
Checking authentication but not authorisation.
WHAT THAT LOOKS LIKE
A signed-in user changing an identifier in a request, and reaching another user's data.
WHAT PREVENTS IT
Verifying, on every action, that this user is entitled to this specific record.
WHAT NOT TO RELY ON
Hiding interface elements.
WHY
The request can be made directly, regardless of what the interface shows.
WHERE TO ENFORCE IT
In the application, at the point of access.
WHAT TO DEFINE
What each role may do, explicitly.
WHAT TO PREFER
Denying by default, and permitting specifically.
WHAT TO BE CAREFUL WITH
Identifiers that are sequential and guessable Endpoints that skip the check because they seem harmless Administrative functions reachable without a check
WHAT TO TEST
Attempting to access another user's record directly, by identifier.
WHAT TO LOG
Authorisation failures.
WHY
Repeated failures indicate someone probing.
