Lesson 1.2
Authentication versus authorization
Authentication is who you are; authorization is what you may do. Broken access control is consistently the most common serious finding.
3mIntermediate12,584 students
Sign in to watch this lesson
Browsing is free. Create an account to play videos and track your progress.
Overview
Authentication is who you are; authorization is what you may do. Broken access control is consistently the most common serious finding.
What this lesson covers
- Separate identity from permission checks
- Enforce authorization on the server, every time
- Catch insecure direct object references
This lesson sits in Thinking About Threats, part of Practical Web Security. It assumes what came before it and leads directly into the next lesson in the module.
In this lesson you will:
- Separate identity from permission checks
- Enforce authorization on the server, every time
- Catch insecure direct object references
Pro Tip
Every authorization check must happen on the server. A hidden button is not a permission.