2021: Access-control tests need more than two roles

Broken access control heads the OWASP Top 10:2021 list. For a business application, a practical response is to test relationships between users and records, rather than checking only whether an administrator sees an extra button.

Build a permission matrix

Take a document endpoint. Test an owner, a colleague in the same organisation, a user from another organisation and an unauthenticated caller. Repeat those cases for read, edit, export and delete.

Then vary the document state. A user who can edit a draft may not be allowed to change an approved record. The combination of role, ownership and state is where simplistic permission tests lose coverage.

Call the API directly

Hiding a control in the browser is useful interface behaviour, but the test must send the request anyway. Change the identifier in the path and submit identifiers in the body that belong to another organisation. Include bulk actions, where one unauthorised record can be hidden among many permitted ones.

Assert both the response and the absence of side effects. A denied request must not update the database, enqueue a notification or generate an export file.

Keep the matrix beside the feature specification. When a product decision changes a permission, the affected tests become visible immediately.

Reference

OWASP Top 10:2021, particularly its broken-access-control category.