Access Control
Overview
Access control decides which users, accounts, or services are allowed to access data and perform actions — the layer that stops an authenticated user from doing more than they should.
Key concepts
- Authorization vs. authentication
- RBAC, least privilege
- Horizontal vs. vertical privilege escalation, IDOR
How it works
Access control decides which users, accounts, or services are allowed to access data and perform actions — preventing users from viewing or modifying resources outside their permissions.
Core terms
| Term | Meaning |
|---|---|
| Authorization | Deciding whether an authenticated user has permission to perform an action. |
| Role-based access control (RBAC) | Permissions assigned based on a user's role. |
| Least privilege | Giving users and systems only the minimum permissions needed. |
| Privilege escalation | Gaining permissions beyond those originally assigned. |
| Horizontal privilege escalation | Accessing another user's account/data at the same permission level. |
| Vertical privilege escalation | Gaining higher-level permissions, e.g. standard user → administrator. |
| Insecure direct object reference (IDOR) | Changing an identifier in a request allows access to another user's data. |
Access control protection
- Check authorization on every protected request.
- Use server-side permission checks instead of relying only on the browser.
- Apply least privilege to all users, services, and accounts.
- Restrict administrative functions to authorized administrators.
- Test applications specifically for access-control weaknesses.