Broken Access Control
By Malcolm McDonald Founder, Editor-in-ChiefAuthor of Grokking Web Application Security
All resources on your site need to have access control implemented, even if they aren't intended to be discoverable by a user.
- Prevalence
- Occasional
- Exploitability
- Moderate
- Impact
- Harmful
What is broken access control?
Broken access control is an authorization vulnerability in which an application fails to check whether a user is permitted to reach a resource or perform an action. Attackers exploit it by guessing URLs or changing identifiers in requests, gaining access to other users' data or to admin functions that were hidden rather than protected.
What you'll learn
- Why hiding a URL is not the same as protecting it
- How attackers guess predictable paths to reach unpublished resources
- How to design, centralize and test access control checks
Where this lesson counts
OWASP Top 10
Users act outside their intended permissions, exposing or modifying data they should never reach. Now includes SSRF.
The canonical A01 flaw: authorization checks that are missing or trivially bypassed.
Learn more about A01PCI DSS v4.0.1
Requirement 6.2.4: engineering techniques must prevent injection, data-structure, cryptographic, business-logic and access-control attacks in bespoke software.
Learn more about 6.2.4Requirement 7.2.1: access to system components and data must follow a defined model based on business need and least privilege.
Requirement 7.2.1 asks for a defined access control model; this lesson shows what happens without one.
Learn more about 7.2.1This lesson includes
Broken Access Control lab
Stan publishes company earnings reports, uploading each one before its release time and linking it later. Follow Olly, a trader who guesses the predictable report URLs and scripts the checks. His firm is investigated for insider trading, and Stan's firm is fined. Based on a real case.
How to prevent Broken Access Control
The prevention guide covers three approaches:
- Design and Document Your Access Control Scheme Upfront
- Centralize Access Control Decisions in Your Codebase
- Test Access Control Critically
Broken Access Control quiz
Two questions. Passing marks the lesson complete.
Sources
- AppSec 101 – Authentication and Authorization Qwiet AI
- Access Control Vulnerabilities PortSwigger
- AWS Identity and Access Management AWS: An example of a very granular, policy-based access control system, that covers all of the Amazon Web Service offerings.
- OWASP Top 10 Broken Access Control Explained Security Journey
Related lessons
Browse all 45 lessons
Directory Traversal
Ensure file paths are safely interpreted, or hackers can access sensitive files on your server.
Privilege Escalation
Privilege escalation occurs when an attacker exploits a vulnerability to impersonate another user or gain extra permissions.
Cross-Site Request Forgery
If an attacker can forge HTTP requests to your site, they may be able to trick your users into triggering unintended actions.
Mass Assignment
Automatically unpacking data from the HTTP request can sometimes be too easy.