Web › Module 5 › Lesson 4
Broken Access Control Patterns
RBAC, ABAC, and consistent server-side checks that close IDOR and privilege escalation gaps
Visual · web_developer
Access control decides what an authenticated user may do. Broken patterns hide checks in the UI, skip APIs, or trust client-sent roles.
Opening
Hidden buttons are not security
If the admin panel link is removed from the HTML but /api/admin/users still works, every user is one curl command away from escalation. Broken access control is OWASP #1 because it appears everywhere: REST APIs, GraphQL, microservices, and mobile backends.
1. Core Models
RBAC
Role-Based Access Control—users have roles (editor, admin) with fixed permissions.
ABAC
Attribute-Based—policies use user dept, resource owner, time of day, etc.
ReBAC
Relationship-based (Google Zanzibar style)—“can edit if shared with you.”
2. Anti-Patterns to Eliminate
• Trusting role=admin in a JSON body without server verification • Checking ownership only in the frontend router • Separate authorization logic copy-pasted per endpoint (drift guaranteed) • “Security through obscurity” UUID URLs with no policy engine • Missing authorization on secondary APIs (export, search, batch)
3. Central Policy Example
Single authorize() used by every handlerdef authorize(user, action, resource): if action == "read" and resource.owner_id == user.id: return True if user.has_role("admin") and action in {"read", "update"}: return True return False @app.get("/invoice/{id}") def get_invoice(id, user=Depends(current_user)): inv = db.get_invoice(id) if not authorize(user, "read", inv): raise HTTPException(403) return inv
def authorize(user, action, resource):
if action == "read" and resource.owner_id == user.id:
return True
if user.has_role("admin") and action in {"read", "update"}:
return True
return False
@app.get("/invoice/{id}")
def get_invoice(id, user=Depends(current_user)):
inv = db.get_invoice(id)
if not authorize(user, "read", inv):
raise HTTPException(403)
return invTest horizontal and vertical moves
In authorized pentests, always try two normal users (horizontal IDOR) and a user vs admin (vertical escalation) on every new endpoint.
Knowledge Check
RBAC assigns permissions based on:
Multiple choice
Knowledge Check
True or False: Hiding admin links in HTML is sufficient access control.
True or False
Knowledge Check
Central authorize() functions help by:
Multiple choice