Broken Access Control

Auditing and fixing authorization gaps — ensuring every route checks who can access which specific resource, not just whether the caller is logged in.

The Core Distinction

Authentication → "Are you logged in?"         (identity)
Authorization  → "Can you access THIS record?" (permission)

Most auth middleware only handles the first. The second must be enforced per-endpoint, per-resource.

Vulnerability Patterns

1. IDOR (Insecure Direct Object Reference)

User supplies an ID; server fetches it without checking ownership.