Worked example - Deciding how to audit the URL for unauthorised requests

Context My client recently found that some users were getting errors using parts of our web application because they were able to perform actions on the front end which they were not authorised to do on the back end. However, the users were not repor...