ROT HACKERSACADEMYStart learning
Courses/Authorization by Design/Lesson 02
02.02 / 55 min

Test vertical access, missing auth, and BFLA

Apply three different policy expectations instead of treating every response difference as IDOR.

By the endTest admin-only operationsTest anonymous accessSeparate BFLA from horizontal object access
Controlled exercise

Use only the Academy Lab on 127.0.0.1:5177. Do not copy these tests to a public system without explicit written authorization.

01

Test the secure admin operation

Choose Admin-only operations. Compare Anonymous, User A, User B, and Admin against the secure audit endpoint.

GET /api/admin/audit
Expected result

Only Admin receives 200; users receive 403 and Anonymous receives 401.

02

Prove vertical BFLA

Change to the admin-insecure route and choose Function-level authorization/BFLA. Run the same matrix.

GET /api/admin-insecure/audit
Expected result

Ordinary users receive the admin-only secret with 200.

03

Test missing authentication

Choose Missing authentication and run the matrix without any stored identity against the public profile route.

GET /api/profile-public?user_id=user_b
Expected result

Anonymous receives user_b’s private email with 200.

MASTERY CHECKPOINT

Prove it before moving on.

You have three separate conclusions: expected vertical control, confirmed BFLA, and confirmed missing authentication.