Loading…
Injection, auth failures, XSS, CSRF, secrets, crypto basics and secure defaults.
A bug ticket says: "Logins work fine, but any logged-in customer can
open /admin/reports and see company revenue." Is this an
authentication bug or an authorization bug? Explain the difference
between the two using this example.
On a food delivery app, a customer notices their receipt is at
/orders/58213/receipt. Changing the number to 58214 shows a
stranger's name, address and order. What is this vulnerability, and
what should the server do on that request?
In a project management app, the "Delete project" button is only shown to project owners. A teammate says that means only owners can delete projects. Why is that not enough?
A code review comment says "make access control deny by default". What does that mean in practice for the endpoints of a web API, and why is it safer than the opposite?
A school portal has students, teachers and administrators. Explain how role-based access control (RBAC) would model who can view grades, edit grades and manage accounts, and what a "permission" is in that model.
A profile update endpoint binds the whole JSON body onto the user entity and saves it: