Bypassing access controls
To be successful in bypassing access controls, you have to either explore misconfigurations or lack of configurations in APIs, or even some backend logic flaw. All mentioned AuthZ mechanisms are strong, but the way they were implemented on an API endpoint may make them useless, or at least vulnerable to some attempts.
For the sake of illustrating this, let’s propose three different scenarios where you have, respectively, RBAC, ABAC, and OAuth scopes in place. Let’s understand how some exploits could be exercised. For RBAC, suppose you have an API that manages employee data, with different roles such as employee and admin. The admin role has access to all employee records, while the employee role can only access their own record. However, the API doesn’t properly validate the user’s role during certain operations. In other words, the following are the case:
- As an employee, you’re only supposed to access your own...
