A5 – Securing access control
In the OWASP Top 10 2013, the A7 vulnerability was Missing Function Level Access Control. For the new 2017 edition, that vulnerability is integrated into the broader Broken Access Control, and is ranked in fifth position. This new category covers vulnerabilities where an unauthenticated or unauthorized user can access restricted information by directly browsing it, or when a low privilege user is able to escalate privileges and even improper configurations of CORS policies.
In this recipe, we will take a look at some recommendations to improve the access control of our applications.
How to do it...
- Assign to users/clients only those privileges that are strictly necessary for them to perform their duties and block access to everything else (the principle of least privilege).
- Ensure that the workflow's privileges are correctly checked and enforced at every step.
- Deny all access by default and then allow users to perform tasks/access information after an explicit verification...
