← Web Application Security (OWASP) learning pathWeb Application Security (OWASP) · Module 5 of 10
Access control
Make sure users can only do what they are allowed to do.
📖 Key ideas
- Broken access control is the #1 OWASP risk.
- Check permissions on the server for every request.
- Verify ownership: a user may only access their own records.
- Deny by default; grant specific roles.
- Never rely on hiding buttons or URLs in the front-end.
💡 Real-life example: Access control is a hostel warden checking each student's key opens only their own room.
Access controlRules for who can do what
Ownership checkVerifying a record belongs to the user
RBACRole-based access control
Deny by defaultBlock unless explicitly allowed