Authentication and Access Control Security

# CHAPTER 10

Authentication and Access Control Security #

1. Introduction #

2. Learning Objectives #

• Differentiate between Authentication (Identity) and Authorization (Access Control).

• Understand the mechanics of Session Management (Cookies and Tokens).

• Identify Insecure Direct Object Reference (IDOR) vulnerabilities.

• Understand the concepts of Horizontal and Vertical Privilege Escalation.

• Apply the Principle of Least Privilege and Role-Based Access Control (RBAC).

3. Beginner-Friendly Explanation #

• Authentication (Who are you?): You walk up to the front desk, show your ID, and type a PIN. The guard verifies you are "Bob" and hands you a blue badge.

• Session Management (Remembering you): You don't have to show your ID at every single hallway. You just wear the blue badge. As long as you have the badge, the building remembers you are Bob.

• Authorization/Access Control (What can you do?): Bob tries to open the "Server Room" door. The door reads the blue badge and says, "Access Denied. Only red badges (Admins) can enter here."

If a hacker steals Bob's blue badge, that's a Session Management failure. If Bob figures out he can just push the Server Room door hard enough to bypass the lock, that's Broken Access Control.

4. Session Management Vulnerabilities #

• Predictable Session IDs: If the server assigns User 1 the Session ID 001, and User 2 the ID 002, an attacker can just guess that Session ID 003 belongs to the next user, hijack it, and become them. Session IDs must be long, cryptographically random, and impossible to guess.

• Session Fixation: An attacker tricks a victim into logging in using a Session ID the attacker generated. The attacker now knows the active Session ID and hijacks the account.

5. Broken Access Control (Privilege Escalation) #

• Horizontal Privilege Escalation (IDOR): Bob logs into his bank account and the URL says bank.com/account?id=100. Bob changes the URL to id=101. The server fails to check if Bob *owns* account 101. It blindly returns Alice's financial data. This is an Insecure Direct Object Reference (IDOR).

• Vertical Privilege Escalation: Bob (a standard user) discovers the URL company.com/admin_panel. The developers hid the link, but forgot to put an authorization check on the actual page. Bob accesses the admin panel and deletes the database.

6. Mini Project: Harden Demo Authentication System #

Step-by-Step Architecture Concept (Secure Remediation):

// DANGEROUS, VULNERABLE CODE (IDOR)
$requested_document_id = $_GET['doc_id'];
// The server blindly trusts the ID provided in the URL
$document = get_document_from_database($requested_document_id);
show_document($document);

// SECURE CODE (Access Control Enforced)
$requested_document_id = $_GET['doc_id'];
$current_logged_in_user_id = $_SESSION['user_id']; // Securely stored on the server

// The database query MUST verify ownership
$document = get_document_if_owned_by_user($requested_document_id, $current_logged_in_user_id);

if ($document) {
    show_document($document);
} else {
    // Stop the attacker!
    die("HTTP 403 Forbidden: You do not own this document.");
}

7. Real-World Scenarios #

8. Best Practices #

• Role-Based Access Control (RBAC): Do not hardcode permissions based on usernames (e.g., if user == 'adminbob'). Assign users to Roles (e.g., Moderator, Viewer). Assign permissions to Roles. Check the Role at every access point. This ensures scalable, centralized security management.

• Hidden UI vs. Real Security: Developers often try to secure admin panels by simply removing the "Admin Dashboard" button from the menu for standard users. This provides zero security. An attacker uses a proxy or directory brute-forcing tool to find /admindashboard.php and accesses it directly. Security must be enforced on the backend server execution, not just by hiding front-end UI elements.

11. Exercises #

1. 1. Explain the operational difference between Authentication and Authorization.

1. 2. What is an Insecure Direct Object Reference (IDOR), and how does it facilitate Horizontal Privilege Escalation?

12. FAQs #

13. Interview Questions #

• Q: Describe the mechanics of a Vertical Privilege Escalation attack. Why is relying on front-end UI obfuscation (hiding links) an insufficient defense against this vulnerability?

• Q: Explain the necessity of implementing Role-Based Access Control (RBAC). How does enforcing server-side ownership validation prevent Insecure Direct Object Reference (IDOR) attacks?

14. Summary #

15. Next Chapter Recommendation #