Authorization Patterns

Authorization determines what actions an authenticated user is allowed to perform.

Authorization Models

• RBAC - Role-Based Access Control
• ABAC - Attribute-Based Access Control
• ACL - Access Control Lists
• ReBAC - Relationship-Based Access Control

Common Vulnerabilities

• Broken access control
• Privilege escalation
• Insecure direct object references (IDOR)
• Missing function-level access control

Best Practices

• Deny by default
• Implement access control at every layer
• Use centralized authorization logic
• Log and monitor access control decisions