First, the key terms.

Principal
The user or workload identity making a request.
Resource-level check
An authorization decision about a specific record or object.

The idea, explained

A signed-in user is not automatically permitted to read every record or use every endpoint. Authorization should be enforced on the server for the specific action and resource, using the current identity and relevant policy. Hiding a button is only a user-interface choice. Sessions and access tokens also require expiry, protection and revocation strategies. A secure design checks access consistently instead of trusting identifiers supplied by the client.

STEP 1

Establish identity

Authentication might verify a session or token. It answers which principal is present, not whether that principal can read every available record. Expired or invalid credentials should not be accepted.

STEP 2

Check the requested action

A student may read their report but not modify grades or read another student’s report. Enforce this on every relevant server request. Never treat a hidden button or an unguessable record ID as the only protection.

Follow a worked example.

A student signs into a school portal and changes a URL from one report ID to another. The server must verify ownership of the requested report, rather than assuming that any authenticated student may access it.

Walk it through, one step at a time

  1. Student A requests report 101, which belongs to A. The server verifies ownership and allows access.
  2. A changes the URL to report 102, owned by B. The same session remains valid, but authorization must reject the request.
  3. Test both cases. A login test alone would miss this vulnerability.

Where people get stuck

Authentication alone does not prevent insecure direct object references.

Now try it yourself.

Pause before opening each answer. Explain your reasoning in your own words.

1. Check the core idea

Where must the decisive permission check happen?

Reveal the answer & reasoning

On the trusted server or resource boundary. Client-side checks can improve the interface but can be bypassed.

2. Apply what you learned

Would a random-looking report ID remove the need for authorization?

Reveal the answer & reasoning

No. IDs can leak or be discovered. The service must verify whether the authenticated principal may perform the action on that resource.