Access Control and Authorization

# CHAPTER 8

Access Control and Authorization #

1. Introduction #

2. Learning Objectives #

• Clearly distinguish between Authentication and Authorization.

• Define the Principle of Least Privilege (PoLP).

• Understand the mechanics of an Insecure Direct Object Reference (IDOR) attack.

• Explain Privilege Escalation (Vertical vs. Horizontal).

• Architect a basic Role-Based Access Control (RBAC) model.

3. Beginner-Friendly Explanation #

• Authentication: You swipe your card at the front door. The system verifies you are a valid employee and lets you into the lobby.

• Broken Access Control: You walk up to the CEO's office. You shouldn't be allowed in, but the door has no lock. You walk in and read confidential files.

• Proper Authorization: You walk up to the CEO's office. You swipe your card. The system checks your "Role." It sees you are a "Junior Developer," not an "Executive," and denies you access, keeping the door locked.

Broken Access Control happens when developers forget to put locks on internal doors, assuming that just because someone is inside the building, they are trusted.

4. Privilege Escalation #

• Vertical Privilege Escalation: An ordinary user figures out how to access an Administrator-only page (e.g., website.com/admin_panel). They escalate *up* the hierarchy to gain god-mode control of the application.

• Horizontal Privilege Escalation (IDOR): An ordinary user (Alice) accesses the private data of another ordinary user (Bob). They don't gain admin rights, but they cross a horizontal boundary to steal data.

5. Insecure Direct Object Reference (IDOR) #

1. 1. Alice logs in. Her account ID is 105. She sees her statement.

1. 2. Alice is curious. She changes the URL to account_id=106 and presses Enter.

1. 3. The Flaw: The application queries the database for account 106 and returns the statement.

6. The Defense: Zero Trust and RBAC #

Defending against IDOR: Never trust the URL parameter. If the URL requests account_id=106, the backend code must perform a check: *"Does the currently logged-in user (from the secure session cookie) have ownership rights over account 106?"* If no, return a 403 Forbidden error.

7. Mini Project: Build Role-Based Dashboard Access #

Secure Workflow Concept:

session_start();

// 1. Enforce Authentication (Are they logged in?)
if (!isset($_SESSION['user_id'])) {
    die(header("Location: login.php"));
}

// 2. Enforce Vertical Authorization (Are they an Admin?)
// Let's assume we want to protect an 'Admin Settings' page
if ($_SESSION['role'] !== 'admin') {
    // Log the suspicious attempt for security monitoring
    error_log("User {$_SESSION['user_id']} attempted unauthorized admin access.");
    // Deny access
    http_response_code(403);
    die("Error 403: You do not have permission to view this page.");
}

// 3. Enforce Horizontal Authorization (Do they own the data?)
$requested_document_id = $_GET['doc_id'];
// Query the database to check ownership: SELECT owner_id FROM documents WHERE id = ?
if ($document_owner_id !== $_SESSION['user_id'] && $_SESSION['role'] !== 'admin') {
    http_response_code(403);
    die("Error 403: You cannot view another user's document.");
}

// If all checks pass, show the document.

8. Real-World Scenarios #

9. Best Practices #

• Fail Securely (Default Deny): When architecting an application, the default state for any resource should be "Access Denied." You must explicitly write code to grant access. If your code crashes or a validation check is bypassed, the system should fail into a secure, locked state, not an open one.

• Use Unpredictable References: Instead of using sequential IDs (user=105), use UUIDs (user=f47ac10b...). While UUIDs do not replace authorization checks, they make it computationally impossible for an attacker to randomly guess another user's ID, providing defense-in-depth against IDOR.

10. Legal and Ethical Notes #

11. Exercises #

1. 1. Define the Principle of Least Privilege (PoLP) and explain why it is a fundamental concept in secure architecture.

1. 2. Explain the difference between Authentication and Authorization, providing a real-world analogy.

12. FAQs #

13. Interview Questions #

• Q: Describe the mechanics of an Insecure Direct Object Reference (IDOR) vulnerability. Provide a backend code architecture strategy to mitigate it permanently.

• Q: A developer implements a security check by verifying that a user's hidden form field contains <input type="hidden" name="role" value="user">. Explain the catastrophic flaw in this access control design.

14. Summary #

15. Next Chapter Recommendation #