Class Central is learner-supported. When you buy through links on our site, we may earn an affiliate commission.

A01: Broken Access Control

Go to class Write review

Overview

This course addresses flaws where improper enforcement of access restrictions allows unauthorized users to access or modify sensitive data or functionality, such as paste snippets or administrative pages, due to unverified input or missing role checks.

Syllabus

Unit 1: Introduction to OWASP

Getting Started

Unit 2: Unverified Account Parameters

Exploiting Unprotected Account Information Endpoint
Adding Input Validation Defense Layer
Implementing Parameterized Queries for Security
Adding Basic Authentication Guards
Building Complete Defense in Depth Security

Unit 3: Preventing Forced Browsing

Exploiting Unprotected Admin Endpoint
Adding Basic Authorization Header Check
Implementing JWT Token Validation
Adding Database Lookup and Admin Role Verification
Creating Reusable Admin Authentication Dependency

Unit 4: Preventing Privilege Escalation

Exploiting Privilege Escalation
Implementing JWT User ID Validation and Self-Profile Updates
Implementing Field Whitelisting to Prevent Privilege Escalation
Implementing Complete Role-Based Access Control

Unit 5: Exposing Sensitive User Data

Exploiting Exposed Sensitive Data
Implementing Proper Password Hashing in Registration
Creating and Applying Data Redaction to Secure Endpoint

Reviews

Start your review of A01: Broken Access Control