LESSON 1.2
Authentication versus authorization
Learn key techniques and workflows in Practical Web Security.
3m
intermediate
12,584 students
Overview
Authentication is who you are; authorization is what you may do. Broken access control is consistently the most common serious finding.
In this lesson you will:
- Separate identity from permission checks
- Enforce authorization on the server, every time
- Catch insecure direct object references
Pro Tip
Every authorization check must happen on the server. A hidden button is not a permission.