This site is the archived OWASP Foundation Wiki and is no longer accepting Account Requests.
To view the new OWASP Foundation website, please visit https://owasp.org
Difference between revisions of "Cornucopia - Ecommerce Website - AZ 4"
(Created page with "{{DISPLAYTITLE:<span style="padding:2px 5px 0px 5px;color:white;background:#d9c049;">Cornucopia - Ecommerce Website - AZ 4</span>}} File:Cornucopia_-_Ecommerce_Website_AZ_4....") |
|||
(One intermediate revision by the same user not shown) | |||
Line 13: | Line 13: | ||
Once an authorization failure is detected, access needs to be blocked. It is also useful to log (associated with the user's identity if possible) and flag these as possibly malicious activity for further analysis, or as input for application intrusion detection systems. | Once an authorization failure is detected, access needs to be blocked. It is also useful to log (associated with the user's identity if possible) and flag these as possibly malicious activity for further analysis, or as input for application intrusion detection systems. | ||
− | NB: the key concept for this card is | + | NB: the key concept for this card is allowing access, even though authorization checks were undertaken and detected a failure. See [[Cornucopia_-_Ecommerce_Website_-_AT_8|AT 8]] for the similar authentication failure. |
=== References: === | === References: === | ||
Line 47: | Line 47: | ||
</tr> | </tr> | ||
</table> | </table> | ||
− | |||
− | |||
− | |||
− | |||
− | |||
<div style="padding:5px;background:LightGray;color:White;font-weight:bold;">[[Cornucopia_-_Ecommerce_Website_-_AZ_3|« Previous Card]] <span style="padding-left:10px;padding-right:10px;">|</span> [[Cornucopia_-_Ecommerce_Website_-_AZ|Authorization]] <span style="padding-left:10px;padding-right:10px;">|</span> [[Cornucopia_-_Ecommerce_Website_-_AZ_5|Next Card »]] </div> | <div style="padding:5px;background:LightGray;color:White;font-weight:bold;">[[Cornucopia_-_Ecommerce_Website_-_AZ_3|« Previous Card]] <span style="padding-left:10px;padding-right:10px;">|</span> [[Cornucopia_-_Ecommerce_Website_-_AZ|Authorization]] <span style="padding-left:10px;padding-right:10px;">|</span> [[Cornucopia_-_Ecommerce_Website_-_AZ_5|Next Card »]] </div> |
Latest revision as of 20:21, 29 March 2016
Suit: Authorization
Card/Value: 4
Description:
Kelly can bypass authorization controls because they do not fail securely (i.e. they default to allowing access).
Technical Note:
Once an authorization failure is detected, access needs to be blocked. It is also useful to log (associated with the user's identity if possible) and flag these as possibly malicious activity for further analysis, or as input for application intrusion detection systems.
NB: the key concept for this card is allowing access, even though authorization checks were undertaken and detected a failure. See AT 8 for the similar authentication failure.
References:
OWASP SCP | OWASP ASVS | OWASP AppSensor | CAPEC | SAFECODE |
---|---|---|---|---|
79 | 4.8 | - | 122 | 8 |
80 | 10 | |||
11 |