Access Control
When the server trusts the client to say who they are. IDOR, privilege escalation, path traversal — the missing check that leaks everything.
Curriculum
12 parts in 5 phasesIDOR: The Missing Check
Insecure Direct Object Reference — when the server trusts the client-supplied identifier without verifying ownership. Change one number, see someone else data.
Path Traversal
Dot-dot-slash and the fight over file boundaries. When an application resolves user-supplied filenames without validation, the filesystem becomes the attack surface.
Privilege Escalation
Horizontal: see another user data. Vertical: become an admin. Both happen when the server trusts a client-supplied role flag or fails to enforce per-action checks.
API Access Control
REST endpoints, GraphQL queries, and the missing auth check that leaks data through every field resolver. Why API access control is harder than page-level auth.
Mass Assignment
The framework binds every field in the request body to a model attribute. Send role=admin in the JSON payload and the model writes it — no explicit code required.
JWT Attacks
alg=none, RS256-to-HS256 confusion, kid injection, weak secret brute-force. The stateless token that lets an attacker forge any identity if the server misconfigures validation.
CSRF
Cross-Site Request Forgery — the browser sends the cookie automatically. An img tag on a forum triggers a password change on a bank the victim left open in another tab.
Access Control Hardening
Server-side ownership checks, deny-by-default, centralised gate functions, and the audit query that finds every missing check before an attacker does.
Session Management
Cookies, session tokens, secure flags, rotation after login. How servers bind an authenticated user to a browser — and how session fixation, predictable tokens, and missing HttpOnly break that binding.
Access Control Case Studies
GitLab (2021) — GraphQL IDOR leaked private projects. Facebook (2018) — View As broke access boundaries. Capital One (2019) — SSRF + path traversal. The root cause in every case: a missing server-side check.
Access Control Review & Practice
A curated set of progressively harder access-control challenges. IDOR, path traversal, privilege escalation, mass assignment, JWT — no hand-holding. The AC course final.