Broken Access Control – The #1 Security Risk in Web Applications

Introduction

According to the OWASP Top 10 (2021), Broken Access Control ranks as the number one web application security risk. It occurs when users can act outside of their intended permissions. This vulnerability can lead to unauthorized access to sensitive data, manipulation of user roles, or performing administrative functions without proper privileges.

In this article, we’ll explore what Broken Access Control is, how it is exploited, and how you can prevent it using best practices in both .NET and Node.js.

Real-World Scenario: Insecure Direct Object Reference (IDOR)

Imagine a banking application where users can view their transaction history using URLs like:

GET /api/transactions/12345        

Where 12345 is the transaction ID. If a user changes the ID to 12346 and views someone else’s transaction, that’s a Broken Access Control vulnerability.

Exploiting Broken Access Control

Attackers can:

• Bypass authentication to access restricted resources.
• Elevate privileges (e.g., regular user to admin).
• Modify or delete other users’ data.

Coding Examples

Node.js (Express)

Vulnerable Code:

app.get('/api/users/:id', (req, res) => {
  const userId = req.params.id;
  // Returns any user's data without checking ownership
  db.getUserById(userId).then(user => res.json(user));
});        

Fix (with ownership check):

app.get('/api/users/:id', authenticateUser, (req, res) => {
  const userId = req.params.id;
  if (req.user.id !== userId && !req.user.isAdmin) {
    return res.status(403).json({ message: 'Forbidden' });
  }
  db.getUserById(userId).then(user => res.json(user));
});        

.NET (ASP.NET Core)

Vulnerable Code:

[HttpGet("api/users/{id}")]
public IActionResult GetUser(int id)
{
    var user = _userService.GetUserById(id);
    return Ok(user);
}        

Fix (with authorization):

[Authorize]
[HttpGet("api/users/{id}")]
public IActionResult GetUser(int id)
{
    var currentUserId = int.Parse(User.FindFirst("sub").Value);
    var isAdmin = User.IsInRole("Admin");

    if (id != currentUserId && !isAdmin)
    {
        return Forbid();
    }

    var user = _userService.GetUserById(id);
    return Ok(user);
}        

Best Practices to Prevent Broken Access Control

• Deny by default: Only grant access to authorized roles.
• Use role-based access control (RBAC) or attribute-based access control (ABAC).
• Validate user identity and ownership at every access point.
• Disable directory listing and hide sensitive endpoints.
• Use access control checks on both server-side and API endpoints.
• Regularly test and audit access control rules.

Conclusion

Broken Access Control is one of the most common and dangerous vulnerabilities because it often results in data exposure or unauthorized actions. By applying strict access checks and validating user permissions in both web and API layers, you can protect your applications from this critical security risk.

In coming days, we’ll cover Cryptographic Failures, exploring how weak encryption or misconfigured SSL can lead to data breaches.

Stay secure! 🚀

#OWASP #WebSecurity #Nodejs #DotNet #AccessControl #CyberSecurity #OWASPTop10

Related Article