{
  "id": 18480452,
  "title": "Testing Broken Access Control Without Guessing",
  "url": "https://urgent.news/2026/11/06/testing-broken-access-control-without-guessing",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-11-06T10:08:05.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/hackbox/testing-broken-access-control-without-guessing-14p4"
  },
  "original_language": "en",
  "account": "Broken access control is a leading issue in the OWASP Top 10 for a decade, and automated tools struggle with this category more than any other. The problem lies in the fact that access control is not a single response pattern, but a relationship between two identities and one object. To test this, two accounts with identical roles and one shared object must be created. Then, every endpoint can be walked using the first account's session and asserting on objects belonging to the second account. This method can be automated. The core of the testing process is simple: create two accounts, A and B, each owning one object, and then check every endpoint with A's session, asserting on objects belonging to B. To ensure the test is valid, the ownership must be established first by fetching B's object with B's token and recording a stable fingerprint. The response must contain B's data, not just an empty array. Comparing the fingerprint against the response confirms the test's validity. Common mistakes include using non-existent ids, testing in the same tenant without different user accounts, trusting UI restrictions, ignoring export and report endpoints, and overlooking field-level filtering. For GraphQL, two checks cover most cases: resolving a global ID with a different session and abusing batch/alias queries. Implementing this testing method in CI ensures that access control regressions are caught early, preventing them from being introduced by ordinary feature work.",
  "summary": "Broken access control has been at or near the top of the OWASP Top 10 for a decade, and it is still the category most automated tools handle worst. The reason is structural: access control is not a pattern in a response, it is a relationship between two identities and one object. You cannot see it in a single request. You have to hold two sessions at once and compare. This is the testing method,…",
  "key_points": [
    "Create two accounts, A and B, each owning one object",
    "Record stable fingerprint of B's object with B's token",
    "Compare fingerprint against response to validate test"
  ],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}