🛡️ OWASP 1 : Broken Access Control
- bharat kumar
- Sep 6
- 2 min read
Updated: Sep 7
Broken Access Control is ranked #1 in the OWASP Top 10 vulnerabilities and remains one of the most exploited issues in modern web applications. This vulnerability arises when applications fail to enforce user privileges and permissions properly, allowing attackers to act outside their intended rights.
Examples:
A normal user accessing admin-only functions.
A logged-out user retrieving restricted content.
An attacker modifying URLs or APIs to gain unauthorized access.
🔎 Types of Broken Access Control
Vertical Privilege Escalation
A user with basic privileges (e.g., customer) accesses higher-privileged actions (e.g., admin panel).
Example: A regular employee viewing HR salary records.
Horizontal Privilege Escalation
A user accesses resources of another user with the same role.
Example: User A viewing/editing User B’s medical records.
Context Bypass (Force Browsing)
Accessing hidden endpoints by guessing/modifying URLs.
Example: Visiting /admin/deleteUser?id=101 directly.
Missing Function-Level Access Control
Application checks access at login but not at every function.
Example: API endpoints accessible without verifying user roles.
🚨 Common Attack Methods
Parameter Tampering → Changing IDs in URLs or API requests.
Forced Browsing → Guessing admin/hidden URLs.
JWT/Token Manipulation → Using stolen or modified tokens.
CORS Misconfigurations → Allowing cross-domain unauthorized access.
✅ Recommendations & Best Practices
> Enforce “Least Privilege”
> Users should only have permissions strictly necessary for their role.
> Deny by Default
> Block all access until explicitly allowed.
> Server-Side Access Checks
> Never rely solely on client-side validation (like JavaScript checks).
> Use Role-Based Access Control (RBAC)
> Implement centralized role/permission checks across APIs and services.
> Secure APIs & Endpoints
> Verify tokens, validate user sessions, and restrict sensitive endpoints.
> Test Regularly
> Perform penetration testing and use automated tools to catch access flaws.
Comments