Checking access to a particular record
A fictional application confirms that a user is signed in, but it returns another customer’s private record without checking ownership or permission. Which control is missing?
A
A rule that private record identifiers must be easy to guess.
B
Server-side authorization for the requested record.
C
A different public logo on the sign-in page.
D
A requirement that all users share the same password.
Question Leaderboard
Not enough data yet to show leaderboard.