🚫 A01:2021 – Broken Access Control Explained

---

Imagine you walk into a hotel, and by mistake, the receptionist gives you a keycard to someone else’s room. You swipe the card, walk in—and suddenly, you're inside a stranger’s room, with full access to their belongings.

That’s exactly what Broken Access Control looks like in the digital world. The system should have verified whether you were authorized for that room—but it didn’t.
Now, imagine this happening on a banking app, a healthcare portal, or a student record system. Scary, right?

🔐Broken Access Control occurs when these restrictions are not properly enforced, allowing attackers to:

• View or modify other users’ data

• Perform unauthorized operations

• Escalate privileges

No wonder it jumped from 5th in 2017 to 1st place in 2021 in the OWASP Top 10 list! A staggering 94% of applications tested showed some form of broken access control, with an average incidence rate of 3.81%.

---

⚠️ Common Examples of Broken Access Control:

• 🔓 Insecure Direct Object References (IDOR): Accessing or modifying someone else’s account using their user ID in the URL

• 🚪 Force Browsing: Accessing internal or admin pages without proper authentication or authorization

• 💥 API Exploits: APIs allowing post, put or delete operations without verifying user permissions

---

🛡️ How to Prevent Broken Access Control:

Access control logic must be implemented securely on the server side, where it cannot be bypassed or modified by attackers.

Here are some effective practices:

• ✅ Enforce Ownership Checks: Validate that users can only access or modify their own data

• 🚫Deny by Default: Unless a resource is public, deny access unless explicitly allowed

• 📜 Log and Alert: Monitor failed access attempts and notify admins when necessary

• 🧱 Use Role-Based Access Control (RBAC): Clearly define what each role can and cannot do

---

🔍 In short:
Broken access control is one of the most exploited vulnerabilities in web apps. It’s crucial to treat all access decisions with strict scrutiny, validate every user’s permission server-side, and never trust client-side enforcement.

👉 In the next post, we'll dive into A02:2021 – Cryptographic Failures, where we explore how weak or misused encryption can put sensitive data at risk.