Unit 02 of 03
Identity, Session and Authorization Errors
Measuring coverage at the points where identity is established and where it is decided who can do what: the user existence leaked by response-time differences and distinct error messages, the session identifier not being renewed at login and not being invalidated at logout, the number of endpoints that perform only role checks, the paths where step order can be skipped, and how many times the same control is passed by concurrent requests.
Published Updated
Lessons
- 01 Authentication Implementation Errors Measuring the implementation error in terms of leaked information: at eight authentication points, a distinct error message, work skipped when no record exists, and a comparison that exits on the first mismatch are counted as three channels, and five points leak; the response-time difference is shown through a band check rather than by writing the raw duration; a countermeasure that closes only one channel closes just one of the five; a central validator that closes all three channels automatically covers the ninth point added; and when a fourth channel is included in the count, the same pattern's number of uncovered points rises to two. 14 min read
- 02 Session Management Errors Counting session decisions over a flow set: four of seven flows raise the session's authorization level, and two of those are fixation points because they do not renew the identifier; two of three invalidation flows delete no record server-side, so eight sessions continue to live on; a central session pattern brings this number down to two; when an eighth flow is added, the number of flows left uncovered in the distributed setup rises to five; and it is measured that the transfer flow, which never calls the pattern at all, is covered only by a pattern tied to the authorization version. 14 min read
- 03 Broken Access Control Deriving, from the authorization matrix, the number of endpoints with no object-level control: five of fourteen endpoints perform only a role check, fourteen of the seventy-two requests that pass the role check reach someone else's object, a central gate built on default-deny brings this number down to zero while stopping ten legitimate requests, and a fifteenth endpoint added without declaring a criterion raises the distributed check's wrongly-passed count to seventeen while opening no new path at the central gate. 14 min read
- 04 Business Logic Flaws Modeling the business logic flaw as a flow of steps: in a five-step dispute-and-refund flow, five hundred and one of the six hundred and twenty-five four-step paths yield a rule-breaking result under per-step authorization, three hundred sixty-nine make a payment, and one hundred thirteen exceed the quota; a state machine brings these numbers down to zero and the paying path down to one, and when a sixth step with an undeclared transition is added, the rule-breaking path count under per-step setup rises to one thousand one hundred seventy-two while the state machine stays at zero, and as the sequence length grows the share of rule-breaking paths rises from sixty percent to ninety percent. 5 min read
- 05 Race Conditions Measuring how many times the same check passes under concurrent requests: for a single-use quota, sixteen concurrent requests pass sixteen times under the unprotected setup, a lock and a single-writer queue bring this down to the quota, and a retry-less atomic compare-and-update, with a quota of three, lets only one request through and rejects two legitimate requests; four of seven checkpoints are unprotected and produce twenty-seven excess passes under eight concurrent requests, a single-writer queue brings this to zero, and when an eighth checkpoint is added the excess passes rise to thirty-four under the distributed setup. 13 min read