Broken Access Control stays #1 because teams ship fast, APIs grow, and authorization checks get scattered. Session weaknesses amplify the damage: once an attacker gets a token, they can move laterally. Here’s how we test, verify impact safely, and fix without killing velocity.
Access Control: The 3 Real Failure Modes
- IDOR (Insecure Direct Object Reference): changing an ID reveals other users’ data.
- Privilege bypass: endpoints that trust the UI instead of server-side roles.
- Scope confusion: multi-tenant apps missing org/account boundaries.
Safe Verification
Prove access control issues with minimal data exposure: validate “can access vs cannot access” using metadata only.
What We Look For (High-Signal Tests)
- Replace resource IDs in URLs and request bodies.
- Replay requests with different role tokens (user → manager → admin).
- Test tenant boundaries: same user, different organization.
- Look for missing checks on “export”, “download”, “admin actions”.
Session Weaknesses That Actually Matter
- Long-lived tokens without rotation or revocation.
- Missing device binding / no refresh-token reuse detection.
- Cookie flags: missing HttpOnly/Secure/SameSite where applicable.
- CSRF gaps on state-changing cookie-auth endpoints.
// Cookie baseline (web apps)
Set-Cookie: session=...; HttpOnly; Secure; SameSite=Lax; Path=/Fix Pattern: Centralize Authorization
Authorization should be a service or middleware with consistent policy evaluation. Avoid “if (role === 'admin')” spread across controllers.
// Pseudocode
authorize(user, action, resource):
assert user.tenantId == resource.tenantId
policy = policies[action]
return policy.evaluate(user, resource)Fix Pattern: Token Rotation + Revocation
- Short-lived access tokens + refresh tokens.
- Detect refresh token reuse (invalidate family on reuse).
- Store session metadata (device, ip hints, lastUsed) for alerts.
Why This Converts
Search intent: “IDOR vulnerability”, “broken access control fix”, “session token rotation”. This content positions you as a team that can protect revenue and reputation with production-grade security.
