Build the Server-Side Authz Check
Apply a subject-object-action-context pattern to repair an object-level authorization flaw.
The reports API authenticates users but does not authorize each report object. A user can change the report ID and read data from another tenant. Subject -> object -> action -> context -> deny-by-default tests The common shortcut is to add if (!user) return 401 or hide report links in the UI. That improves the normal path but leaves the server action unable to answer whether this user may read this specific report. Subject Identify the authenticated subject as user ID, tenant ID, roles, and current session assurance level. Authentication creates facts for the authorization decision. It does not grant…
Sign up free — one personalized lesson every day, matched to your role and goals.
Already have an account? Sign in