A valid login is not a permission check
Follow one request from identity to resource access, and find the security decision that authentication alone cannot make.
AppSec Series.
Follow the data from request to response. Learn to find, understand, and prevent application vulnerabilities.
Articles in this series
What this series explores
- 01Authentication and sessions
- 02Access control
- 03Input and output handling
- 04Secure code review