ROT HACKERSACADEMYStart learning
Courses02 / CORE SECURITY

Authorization by Design

Use matrices, explicit policies, semantic comparison, bounded object mutation, and safe writes to prove authorization failures.

Practitioner6–8 hours5 lessons5 guided labs
Begin lesson 01 ↗
COURSE SYLLABUS

Do the work in order.

  1. 01
    55 min

    Prove horizontal IDOR / BOLA

    Run a four-identity access matrix against secure and insecure object routes and save the true positive.

  2. 02
    55 min

    Test vertical access, missing auth, and BFLA

    Apply three different policy expectations instead of treating every response difference as IDOR.

  3. 03
    50 min

    Test tenant isolation and ownership

    Model tenant membership and resource ownership as different authorization dimensions.

  4. 04
    65 min

    Test GraphQL authorization

    Compare secure and vulnerable GraphQL fields while accounting for GraphQL’s common 200-with-errors behavior.

  5. 05
    70 min

    Run a safe state-changing test

    Test PATCH authorization with dry-run, explicit confirmation, before/after evidence, strict limits, and rollback.