Access control: the four patterns that keep reappearing

Why this class dominates

Access control is logic, so scanners struggle with it and developers implement it inconsistently across a codebase. Four patterns cover most of what I find in authorised labs and reviews.

Pattern 1 — Unscoped lookup

A detail endpoint loads a record by identifier while the list endpoint filters by owner. Remediation: scope at the data layer so an unscoped query cannot be written by accident, and apply a policy at the controller boundary.

Pattern 2 — Client-side enforcement

The interface hides a control; the endpoint behind it does not check the role. Remediation: treat every hidden control as an unauthenticated request and enforce the role server-side.

Pattern 3 — Role assumed from input

A parameter, hidden field or cookie carries the role. Remediation: derive privilege only from server-side session or token state; never from anything the client can edit.

Pattern 4 — Forgotten sibling route

Export, print, PDF and API variants of a protected page are missed. Remediation: enumerate every route that reaches the resource and test all of them, not the representative one.

Verification

For each fix, log in as a second account and repeat every request against the first account's resources, expecting 403 with no information disclosure in the body or timing. Encode this as automated tests so a new route cannot regress it.