{
  "id": 10062334,
  "title": "Authentication vs Authorization: Reaching an Admin Panel Without the Password",
  "url": "https://urgent.news/2026/09/26/authentication-vs-authorization-reaching-an-admin-panel-without-the",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-09-26T20:41:23.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/armando284/authentication-vs-authorization-reaching-an-admin-panel-without-the-password-55p9"
  },
  "original_language": "en",
  "account": "The source material describes a case where a web app developer failed to implement proper authorization measures, allowing unauthorized access to an admin panel without needing the password. The key points are:\n\n1. Authentication was functioning correctly, confirming the user's identity and maintaining a valid session. However, the authorization process (deciding what actions the authenticated user can perform) was inadequate.\n\n2. A button to access the admin panel did not render for regular users, but the route behind it still responded to requests. This suggests that the authorization check was not occurring at the server level, only on the client-side.\n\n3. Using a browser's developer tools, the developer identified that the route existed even though it wasn't rendered for the non-admin user. Requests to this route were answered successfully by the server, without any role-based authorization check.\n\n4. The developer used a proxy tool (Burp) to capture and replay requests, revealing that the admin endpoints did not re-check the user's role after the initial authentication. This allowed the non-admin user to access administrative functionality directly using their legitimate session and role.\n\n5. The core issue was that the system trusted the client-side visibility checks (show/hide elements based on user role) rather than relying on server-side role-based authorization for every resource. This is a classic example of \"broken access control,\" where the server only assumes the client's permission checks are sufficient.\n\n6. The developer acknowledges that this could have happened to them in the past, highlighting the risk of overlooking authorization checks during development, especially when time constraints or design decisions (like hiding UI elements) are taken.\n\nIn summary, the story emphasizes the importance of implementing robust server-side authorization checks, rather than relying solely on client-side visibility controls. It illustrates how a seemingly minor oversight can lead to unauthorized access to sensitive areas of an application, without any need for password brute-forcing or session theft.",
  "summary": "Authentication vs Authorization: Reaching an Admin Panel Without the Password TL;DR: The login worked the entire time. The button that led to the admin panel didn't render for my role, the route behind it still answered, and the server never asked what my role was allowed to do. Authentication gets you in; authorization decides what you can do once you're in, and the app only did the first one. A…",
  "key_points": [],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}