Authorization security

Authorization Security

Purpose

Find the access-control holes that dominate real breaches: broken object-level authorization (IDOR/BOLA), missing ownership/tenant scoping, privilege escalation, and trust of client-supplied identity — and prove they're closed with negative tests. The review lens; construction is ../../backend/backend-authorization + ../../backend/ownership-authorization.

When to Use

• Reviewing authorization design or implementation for security.
• As the access-control slice of ../../security-review and threat-modeling elevation/disclosure threats.
• Not for building authorization (backend pack) or authentication (authentication-security).

Inputs

• The authorization design/implementation + endpoint inventory (../../backend/backend-authorization, ../../backend/ownership-authorization).
• Tenancy/ownership model; threat model's access threats.

Discovery Questions

• For each protected resource: is ownership/tenant scope enforced in the query, or fetched-then-maybe-checked (or not at all)?
• Are any ownership/tenant IDs taken from the client (body/query/params) and trusted for scoping?
• Can a non-admin reach admin functions (function-level access), or a user escalate role?
• Are all access paths covered — HTTP, GraphQL resolvers, background jobs, exports, admin tools?

Responsibilities

• Hunt IDOR/BOLA: verify User A cannot access User B's resource by ID at every object-level endpoint; scope must be enforced in the query from session context, not checked after load or skipped (../../backend/ownership-authorization).
• Verify no client-supplied ID is trusted for scope: body.userId/orgId never widen access; scope derives from the session.
• Check tenant isolation everywhere: every query on tenant data carries the tenant filter — including jobs, exports, and admin tooling (cross-tenant access is its own audited permission, not a missing filter).
• Check function-level authorization: admin/privileged actions reject non-privileged callers; no privilege escalation via role mutation or mass assignment (../../backend/role-permission-design).
• Confirm coverage across paths: resolvers (../../backend/graphql-api-design), jobs, webhooks — not just REST happy paths.
• Require the negative-test suite as proof (../../backend/backend-integration-testing, security-regression-testing): cross-user, non-admin→admin, client-supplied-ID-ignored, cross-tenant-rejected.

Required Workflow

1. Map protected resources/actions to their required scope checks.
2. Verify query-level ownership/tenant enforcement (not fetch-then-check).
3. Test client-supplied ID/role trust (attempt to widen scope).
4. Check function-level access + escalation paths.
5. Confirm coverage across all access paths.
6. Record findings; require negative tests as the fix's proof.

Decision Rules

• Missing ownership/tenant check on an object endpoint = confirmed high-severity (IDOR/BOLA) — the most common real breach.
• Role checks do not substitute for ownership checks — an authorized role still only touches its own/tenant data unless the model says otherwise.
• Any scope derived from client input is a finding until proven ignored.
• A protected path without a negative test is unverified — treat as a gap.

Rules

• Findings separated Confirmed vs Potential; never declare authorization "secure" (../../security-review).
• Every finding's fix is proven by a negative test.
• Coverage includes non-HTTP paths (jobs, exports, admin).

Anti-Patterns

• Passing an endpoint because it "requires login" (authentication ≠ authorization).
• Role-only checks with no per-resource ownership/tenant check.
• Trusting body.orgId/userId for scoping.
• Reviewing REST but ignoring resolvers/jobs/exports.
• Accepting a fix with no cross-user/cross-tenant negative test.

Validation Checklist

• Ownership/tenant enforced in-query at every object endpoint.
• No client-supplied ID/role trusted for scope.
• Tenant filter on all paths incl. jobs/exports/admin.
• Function-level access + escalation checked.
• Coverage across REST/GraphQL/jobs/webhooks.
• Negative-test suite proves each fix.

Definition of Done

A recorded authorization security assessment — IDOR/BOLA, ownership/tenant scoping, escalation, client-ID trust, and cross-path coverage — with Confirmed/Potential findings each proven closed by a negative test, and no "secure" claim.

Related Skills

../../backend/backend-authorization, ../../backend/ownership-authorization, ../../backend/role-permission-design, ../../backend/backend-integration-testing, security-regression-testing, api-security, ../../security-review, threat-modeling, database-security.

Related Knowledge

../../../knowledge/ (tenancy model, sharing rules, access threats).

Related References

../../../references/security/ (authorization review checklists, when populated).

Context Loading Guidance

• Requires: authorization design/impl, endpoint inventory, tenancy model.
• Does not require: authentication internals, unrelated code.
• May load: ../../backend/ownership-authorization, security-regression-testing.
• Stop when: findings + negative-test-proven fixes are recorded.

Token Efficiency Guidance

The endpoint × scope-check × negative-test matrix is the artifact; focus on object-level and tenant paths where breaches concentrate.