This site is the archived OWASP Foundation Wiki and is no longer accepting Account Requests.
To view the new OWASP Foundation website, please visit


Revision as of 14:07, 22 May 2008 by Yehohanan7 (talk | contribs) (Accidental leaking of sensitive information through data queries)

(diff) ← Older revision | Latest revision (diff) | Newer revision → (diff)
Jump to: navigation, search

Access control enforced by presentation layer


Enforcing access control in the presentation layer means that the developer does not show buttons and links for functions and assets that are not authorized for the user

Example in our application:

The payment button will be not shown in the payment page if the holiday is already booked.


Forced Browsing


Access control must be performed in the business layer, not only the presentation layer.

Accidental leaking of sensitive information through data queries

SQL Injection