Web Application Security · 3.3

🚪 Broken Access Control

The #1 web risk — reaching what you shouldn't⏱ ~2 min

Broken Access Control sits at the top of the OWASP Top 10 because it's both extremely common and extremely damaging. It means the application fails to properly enforce what each user is allowed to do or see.

🎫A hotel keycard that opens every room

Your hotel keycard should only open your room. Imagine if changing the last digit of your room number on the card let you into any room in the building. Broken access control is exactly this — the system checks that you're logged in, but fails to check that the specific thing you're asking for is actually yours.

Common Forms

TypeWhat Happens
Insecure Direct Object Reference (IDOR)Changing an ID in a URL (e.g., /invoice/123 → /invoice/124) shows someone else's data
Privilege escalationA normal user performs admin-only actions
Missing function-level checksAdmin pages are 'hidden' but not actually protected — just knowing the URL grants access
Forced browsingReaching restricted pages by typing their URLs directly

The IDOR Example Everyone Should Understand

You view your invoice at a URL ending in /invoice?id=1005. Out of curiosity you change it to /invoice?id=1006 — and you see another customer's invoice. The app checked that you were logged in, but never checked that invoice 1006 belonged to you. That's IDOR, a form of broken access control, and it's shockingly common.

🔒 SecurityThe fix is server-side authorization checks on every request: the server must verify, for each action, that this specific user is allowed to access this specific resource — never trusting the client, a hidden field, or a URL. 'Security by obscurity' (just hiding the link) is not access control.
⚠ WarningIf you ever discover IDOR or similar on a real site you use, do NOT go browse other people's data — that crosses into unauthorized access. Note it, stop, and report it responsibly through the site's security contact or bug bounty program.
🧠Quick Checkfirst try = +5 XP

You change /invoice?id=1005 to id=1006 and see someone else's invoice. This flaw is…

0 XP🔥 0 days