This site is the archived OWASP Foundation Wiki and is no longer accepting Account Requests.
To view the new OWASP Foundation website, please visit https://owasp.org

Cornucopia - Ecommerce Website - AZ 6

From OWASP
Revision as of 16:24, 21 January 2016 by Dariodf (talk | contribs)

(diff) ← Older revision | Latest revision (diff) | Newer revision → (diff)
Jump to: navigation, search
Cornucopia - Ecommerce Website AZ 6.png

Suit: Authorization

Card/Value: 6

Description:

Eduardo can access data he does not have permission to, even though he has permission to the form/page/URL/entry point.

Technical Note:

Even though a user may be permitted access to a particular page, the contents of that page should also verify access control privileges. For example, a user should be able to edit their own profile text, but not that for another user. Implement least privilege, and restrict users to only the data and system information that are required to perform their tasks.

NB: the key concept for this card is applying authorization controls at the data level. See AZ 5 for resource types controls, and AZ 7 for function/object/property controls.

References:

OWASP SCP OWASP ASVS OWASP AppSensor CAPEC SAFECODE
81 4.1 ACE1 122 8
88 4.3 ACE2 10
131 4.4 ACE3 11
15.7 ACE4


« Previous Card | Authorization | Next Card »