This site is the archived OWASP Foundation Wiki and is no longer accepting Account Requests.
To view the new OWASP Foundation website, please visit https://owasp.org

Difference between revisions of "OWASP Periodic Table of Vulnerabilities - Insufficient Authentication/Authorization"

From OWASP
Jump to: navigation, search
m
m
 
(3 intermediate revisions by 2 users not shown)
Line 5: Line 5:
 
=== Root Cause Summary ===
 
=== Root Cause Summary ===
  
Incorrect verification of identity and permissions can results to an attacker accessing sensitive data or functionality without properly being authenticated and/or authorized to do so.
+
Incorrect verification of identity and permissions can result in an unauthorized attacker accessing sensitive data or functionality.
  
 
=== Browser / Standards Solution ===
 
=== Browser / Standards Solution ===
Line 13: Line 13:
 
=== Perimeter Solution ===
 
=== Perimeter Solution ===
  
Whenever possible, apply server-side Access Control Lists for those sections of sensitive data that should't be publicly accessible.
+
None
  
 
=== Generic Framework Solution ===
 
=== Generic Framework Solution ===
  
Use an authentication framework.<br>
+
Enforce a proven authentication and authorization framework scheme which emphasizes policy-based configuration files over hard-coded authentication/authorization checks wherever possible.
Deny all access by default, and explicitly grant access per item.
+
 
 +
Deny all access by default, and explicitly grant access per resource.
 +
 
 +
Enforce data storage outside of web roots to prevent requests which bypass the application's access control policy.
  
 
=== Custom Framework Solution ===
 
=== Custom Framework Solution ===
Generate easy configurable role-based authentication and authorization policies.<br>
+
 
Apply least-privilege principle to all transactions, requiring authentication and authorization wherever applicable.
+
None
  
 
=== Custom Code Solution ===
 
=== Custom Code Solution ===
  
None
+
Always apply least-privilege principle to all transactions and data access. Define access control matrix for all features and implement policy before implementing the feature.
  
 
=== Discussion / Controversy ===
 
=== Discussion / Controversy ===
  
 +
None
  
 
=== References ===
 
=== References ===
 
+
[https://www.owasp.org/index.php/Guide_to_Authorization Guide to Authorization (OWASP)]<br>
 +
[https://www.owasp.org/index.php/Top_10_2010-A8-Failure_to_Restrict_URL_Access Failure to Restrict URL Access (OWASP)]<br>
 
[http://projects.webappsec.org/w/page/13246939/Insufficient%20Authentication Insufficient Authentication (WASC)]
 
[http://projects.webappsec.org/w/page/13246939/Insufficient%20Authentication Insufficient Authentication (WASC)]

Latest revision as of 21:48, 20 July 2013

Return to Periodic Table Working View

Insufficient Authentication/Authorization

Root Cause Summary

Incorrect verification of identity and permissions can result in an unauthorized attacker accessing sensitive data or functionality.

Browser / Standards Solution

None

Perimeter Solution

None

Generic Framework Solution

Enforce a proven authentication and authorization framework scheme which emphasizes policy-based configuration files over hard-coded authentication/authorization checks wherever possible.

Deny all access by default, and explicitly grant access per resource.

Enforce data storage outside of web roots to prevent requests which bypass the application's access control policy.

Custom Framework Solution

None

Custom Code Solution

Always apply least-privilege principle to all transactions and data access. Define access control matrix for all features and implement policy before implementing the feature.

Discussion / Controversy

None

References

Guide to Authorization (OWASP)
Failure to Restrict URL Access (OWASP)
Insufficient Authentication (WASC)