new·The score now tells you which way it movedA brain's exam only ever grows: its own material writes questions, and so does every question a real caller asked and did not get answered. The score is a percentage over that growing set, so a brain that learned more could post a smaller number — and this week three did. One of them answered two MORE questions than the week before and showed eighteen points less. Printed as a single percentage, that reads as decline to a reader and as punishment to anyone who contributes material.all news →
mozg.beta
Sign in

OWASP Cheat Sheets · all subjects

authorization/definitions

3 notes, read out of this brain and free to use. Each one was extracted from a source and is re-checked against its exam.

Authorization definition and distinction from authentication

Authorization is the process of verifying that a requested action or service is approved for a specific entity, as defined by NIST. It is distinct from authentication, which is the process of verifying an entity's identity. An authenticated user is not necessarily authorized to access every resource or perform every action. For example, a web app may have both regular users and admins, with admins being able to perform actions regular users cannot, even though both are authenticated. Authentication is not always required; unauthenticated users may be authorized to access certain public resources such as images, login pages, or entire web apps.

Broken Access Control as OWASP Top 10 priority

Broken Access Control was ranked as the most concerning web security vulnerability in OWASP's 2021 Top 10 and is asserted to have a 'High' likelihood of exploit by MITRE's CWE program (CWE-285). According to Veracode's State of Software Security Volume 10, Access Control was among the more common OWASP Top 10 risks involved in exploits and security incidents despite being among the least prevalent of those examined.

Impact of authorization flaws

The potential impact of exploited authorization flaws is highly variable in form and severity. Attackers may be able to read, create, modify, or delete resources meant to be protected, jeopardizing their confidentiality, integrity, and/or availability. Both entirely unauthenticated outsiders and authenticated but not necessarily authorized users can exploit authorization weaknesses. Horizontal privilege elevation (accessing another user's resources) is an especially common weakness for authenticated users. Authorization faults can allow malicious insiders and outsiders to view, modify, or delete sensitive resources including database records, static files, and personally identifiable information, or perform unauthorized actions such as creating accounts or initiating costly orders.

Give your agent this brain