Java Authorisation
Deciding what an authenticated caller may do. The failures here are quiet and are found by users, not by tests.
2 concepts · 6 interview questions
What this topic covers
Every concept in authorisation, and the questions each one gets asked as. Where a question links, it has a full write-up.
Roles, permissions and scopes
Role-based access is coarse and easy to reason about; attribute or permission-based access is finer and harder to audit.
- RBAC or ABAC?
- Where should an authorisation check live?
- How do you authorise in a microservice architecture?
Broken access control
The most common serious web vulnerability: an endpoint checks that you are logged in and not that the record belongs to you.
- What is an insecure direct object reference?
- How do you test for missing ownership checks?
- Is hiding a button in the UI an access control?