Lesson 5 of 11 · 7 min read
Broken Access Control and IDOR
Broken access control covers every way a user acts outside their intended permissions: reading other users' objects by changing an ID (IDOR, or broken object-level authorization), calling privileged functions directly, changing fields they should not (mass assignment), or crossing tenant boundaries. It tops both the OWASP web and API risk lists because authorization must be correct on every endpoint. Central policy, object-level checks in the data layer and two-user tests prevent most of it.
free sign-in, no card required
Practise it as an interviewer asks it
What is the difference between authentication and authorization, and where does each usually fail?What do SQL injection, command injection and template injection have in common, and why does parameterisation fix SQL injection?How is securing an LLM application different from ordinary application security, and what stays exactly the same?Explain XSS and how contextual output encoding and CSP prevent it.What is SSRF, and why do LLM tools that fetch URLs bring it back?What is model extraction, what does the attacker gain, and how do you detect and limit it?