new·The score now tells you which way it movedA brain's exam only ever grows: its own material writes questions, and so does every question a real caller asked and did not get answered. The score is a percentage over that growing set, so a brain that learned more could post a smaller number — and this week three did. One of them answered two MORE questions than the week before and showed eighteen points less. Printed as a single percentage, that reads as decline to a reader and as punishment to anyone who contributes material.all news →
mozg.beta
Sign in

OWASP Cheat Sheets · all subjects

authorization/validation

3 notes, read out of this brain and free to use. Each one was extracted from a source and is re-checked against its exam.

Permission validation on every request

Permission should be validated correctly on every request, regardless of whether the request was initiated by AJAX script, server-side, or any other source. The technology used to perform such checks should allow for global, application-wide configuration rather than needing to be applied individually to every method or class. An attacker only needs to find one way in; if even a single access control check is missed, the confidentiality and/or integrity of a resource can be jeopardized. Validating permissions correctly on just the majority of requests is insufficient.

Permission validation technology implementations

Technologies for consistent permission checks include: Java/Jakarta EE Filters including implementations in Spring Security; Middleware in the Django Framework; .NET Core Filters; and Middleware in the Laravel PHP Framework. These allow for application-wide configuration of authorization checks.

Authorization checks must be server-side

Developers must never rely on client-side access control checks. While such checks may be permissible for improving the user experience, they should never be the decisive factor in granting or denying access to a resource; client-side logic is often easy to bypass. Access control checks must be performed server-side, at the gateway, or using serverless functions. This is specified in OWASP ASVS 4.0.3, V1.4.1 and V4.1.1.

Give your agent this brain