Securein progress

Don't Get Owned 101

Authentication, authorisation, validation, secrets, backups.

authentication

Who are you?

A door with a lock. The key either fits or it doesn't. Failure looks like 401.

authorization

What are you allowed to do?

You're inside the building. Which rooms open for your badge? Failure looks like 403.

// same person, two different questions

alice signs in with the right password

→ authentication PASSES — the server now knows she is alice

alice requests /customers/bob

→ authorization FAILS — she is alice, and this row is bob's

AUTHENTICATION

Who are you?

plain englishProving identity — signing in with a password, a code, or a provider like Google.

the mistake people make

Trusting a user id sent from the browser instead of reading it from the verified session.

your call

An endpoint returns 403 for a signed-in user. What kind of problem is it?

don't get owned 101

If a rule only exists in your interface, it does not exist.

Hiding a button, disabling an input and skipping a page in the router are all UX. Anyone can send the request anyway. Every rule that matters is enforced on the server or in the database.

next labDatabase Permissions →