Tag feed

#access-control

166 posts6 followers

Explore Hashnode

Alternatives

Trending tags this week

CTCruxtab Technologies Pvt. Ltd.cruxtab-technologies.hashnode.dev1d ago · 7 min read

Adding Plan-Based Feature Gates to a Shopify Bundle Listing Page

Subscription-based Shopify apps eventually face an important architectural question: Where should feature access be enforced? A bundle-builder application may have several plans. One merchant may have

0

ABAuth By Exampleauthbyexample.hashnode.dev2d ago · 3 min read

MFA step-up is not object authorization

A second factor proves the person is still at the keyboard. It does not decide whether that person may read, edit, export, or delete a specific resource. The bug pattern A common flow: User tries a s

0

WWendelaboveinfranet.hashnode.dev2d ago · 6 min read

Understanding the Technical Flow of an RFID Hotel Lock System

RFID hotel lock systems look simple to guests: receive a key card, tap it on the door reader, and enter the room. Technically, the process involves several components working together: Hotel Lock Soft

0

ABAuth By Exampleauthbyexample.hashnode.dev3d ago · 3 min read

Soft-delete does not revoke access

Soft-delete is a data lifecycle choice. Authorization is a security decision. Mixing them up is how tombstoned rows keep answering "yes" long after the product thinks they are gone. The bug pattern A

0

ABAuth By Exampleauthbyexample.hashnode.devSep 21 · 1 min read

A background job still needs a subject

Cron and queue workers often skip authorization because "there is no user." That creates a god-mode path. Give the job a service identity with the narrowest permissions it needs, and still check those

0

ABAuth By Exampleauthbyexample.hashnode.devSep 20 · 1 min read

A feature flag is not an authorization check

Feature flags are great for rollouts. They are a poor substitute for authorization. A flag answers: “Is this code path on for this cohort?” An authz check answers: “Is this principal allowed to do thi

0

ABAuth By Exampleauthbyexample.hashnode.devSep 20 · 1 min read

Logged in is not a permission

A successful login answers one question: who is this? Authorization answers a different one: may this principal do this action on this resource right now? Treating "the user is authenticated" as enoug

0

ABAuth By Exampleauthbyexample.hashnode.devSep 19 · 1 min read

Fail closed when authorization is unavailable

When your policy engine, PDP, or permissions service times out, what does the API do? Returning 200 “just this once” so the page keeps working is fail-open. An attacker who can jam or delay that depen

0

ABAuth By Exampleauthbyexample.hashnode.devSep 19 · 1 min read

Temporary elevation needs a clock

Break-glass and "just this once" admin grants are where authorization quietly becomes permanent. If someone needs elevated access to fix production, grant it with: A hard expiry (minutes or hours, no

0

DEDavid Essiendavid-essien.hashnode.devSep 19 · 6 min read

One Missing Parameter Cost Me Six Hours (PortSwigger Lab)

I spent six hours trying to upgrade a non-admin user to admin, convinced I was missing some clever bypass. The gap turned out to be one field in a request body I'd already looked at twice. This is a P

2

M

#access-control

Search Hashnode

#access-control

Explore Hashnode

Trending tags this week

Adding Plan-Based Feature Gates to a Shopify Bundle Listing Page

MFA step-up is not object authorization

Understanding the Technical Flow of an RFID Hotel Lock System

Soft-delete does not revoke access

A background job still needs a subject

A feature flag is not an authorization check

Logged in is not a permission

Fail closed when authorization is unavailable

Temporary elevation needs a clock

One Missing Parameter Cost Me Six Hours (PortSwigger Lab)