Working through an Access Control Lab

I completed PortSwigger's Unprotected admin functionality lab on October 24. Nothing in it was new to me; it was practice. I'm writing about it because I want to document my preparation for PWPA.

The lab focuses on access control. Before looking for a solution, consider the boundary the application should enforce. Who should be able to reach restricted functionality, and who should be able to use it?

Authentication and authorization answer different questions. Authentication establishes identity. Authorization determines which actions that identity is permitted to perform. A user being logged in does not, by itself, give that user administrative permission.

Permission checks need to apply to the request that performs the restricted action, not only to the page displaying it. Hiding a control does not enforce that restriction on the server.

For regression testing, check that an unauthorized request is denied and that the prohibited change has not occurred. Also check that authorized use still works as intended.

I want this journal to make room for practicing fundamentals while pursuing a deeper understanding of AppSec.

If you're working through this exercise yourself, use the authorized training environment and keep your testing within its scope.

Practice the PortSwigger lab · Read OWASP's authorization guidance