Academy
Apprentice track

Broken Access Control

IDOR and missing checks: asking for someone else's objects by number.

Create a free account to track progress and earn the certificate. You can read the syllabus below without one.

Final exam

3 questions in 10 minutes, 3 to pass. Certificates require it.

Take the exam
  1. 01How broken access control worksAuthentication is not authorization. IDs are not secrets.
  2. 02Lab: somebody else's orderAn order viewer with no ownership check. Read order 102.
  3. 03Access control quizThree questions on IDOR, escalation directions, and the fix.