SecLab
Access ControlchallengeDifficulty 4/533 min

Challenge: patch a BOLA-ridden service

Objective: After this lesson you can write an authz matrix test in CI — the thing that stops this whole module recurring.

V8API5:2023API1:2023A01:2025access-control
Step 1 of 5 · read3 min

The goal

The previous five lessons gave you five layers: the clause in the query, deny-by-default in the pipeline, a separate input DTO, a centralised rule, RLS at the data tier. This lesson is the sixth layer, and it differs in kind from the other five: it blocks nothing — it detects when the other five are removed.

The setup differs from m1-challenge deliberately: there you classified and ordered. Here you write code, and that code has to still work after you leave the project.

What to produce. A contract-management service has four endpoints and three roles. The full matrix is 4 endpoints × 3 roles × 2 (owner / non-owner) = 24 cases. Write one test that generates all 24 and asserts the right outcome for each.

Why this sits at difficulty 4: the hard part is not writing the test but deciding the expected outcome of those 24 cells. Some are obvious. Some are business decisions nobody has written down, and having to fill them into a table is the first time the question gets asked at all.

View path

Comments

Join the discussion
Sign up to comment

Commenting needs an account with at least one completed lesson. That condition is what keeps this thread worth reading: every point belongs to someone who can be asked back, and reputation accrues over time.

Sign upSign in

You can still read every comment below without an account. Signing in brings you back to this exact spot, not to the top of the page.

Loading comments…