Access Control Patterns

Prevent users from accessing data or actions they are not allowed to access. Broken Access Control is OWASP A01 because it is the most common serious web vulnerability: user A can read user B's invoice, change another tenant's settings, or call an admin endpoint by guessing an ID.

The Rule

Authentication proves who the user is. Authorization proves what the user can do. You need both on every protected operation.

Core Principles

1. Deny by default -- no route is public unless explicitly marked public
2. Check authorization server-side -- never trust hidden buttons or client checks
3. Scope every query by user or tenant -- never fetch by raw ID alone
4. Use centralized policies -- avoid scattered if (user.role === 'admin') checks
5. Separate roles from permissions -- roles are bundles, permissions are actions
6. Audit sensitive decisions -- log denied and privileged actions

Vulnerable Patterns