This site is the archived OWASP Foundation Wiki and is no longer accepting Account Requests.
To view the new OWASP Foundation website, please visit https://owasp.org
Cornucopia - Ecommerce Website - AZ 6
Suit: Authorization
Card/Value: 6
Description:
Eduardo can access data he does not have permission to, even though he has permission to the form/page/URL/entry point.
Technical Note:
Even though a user may be permitted access to a particular page, the contents of that page should also verify access control privileges. For example, a user should be able to edit their own profile text, but not that for another user. Implement least privilege, and restrict users to only the data and system information that are required to perform their tasks.
NB: the key concept for this card is applying authorization controls at the data level. See AZ 5 for resource types controls, and AZ 7 for function/object/property controls.
References:
| OWASP SCP | OWASP ASVS | OWASP AppSensor | CAPEC | SAFECODE |
|---|---|---|---|---|
| 81 | 4.1 | ACE1 | 122 | 8 |
| 88 | 4.3 | ACE2 | 10 | |
| 131 | 4.4 | ACE3 | 11 | |
| 15.7 | ACE4 |
