intermediate · 24 minute study

Authorize the actual resource on every entry path

A protected page can still call an unprotected endpoint. Security must survive a direct request that skips the intended interface.

Loading progressEvidence grows with practice

Useful preparation · 1 prerequisite

Use this as a map, not a lock. If these ideas are familiar, continue.

Choose the test that can actually prove the claim — One green test is not evidence for every layer of a feature. The right test reaches the boundary where the claimed behavior is enforced.

First, build a mental model

Authentication answers who is asking. Authorization answers whether that actor may perform this action on this actual resource now.

Establish identity from a verified session or token, not a userId/role in request JSON. A signed-in user is still an untrusted caller for arbitrary resource access.
Resolve resource ownership and tenant scope at the trusted boundary. Check submitted parent/child IDs independently so an allowed company ID cannot hide a foreign record.
Use least privilege and deny by default. View, edit, export, administration and paid entitlement are distinct capabilities.
Session cookies/tokens, CSRF defenses, server permissions and database policies solve related but different problems. UI hiding and route organization grant no authority.

Read the codetext · educational example

Request: edit note-B using a company-A page
Verified actor: Alice
Actual resource company: B
Alice memberships: A
Required capability: edit note in B
Decision: deny; changing the page does not change authority

Actor
The session identifies Alice, not whichever user ID the payload claims.
Resource
The note itself belongs to B even if the request also contains company A.
Decision
Alice's A membership does not authorize modifying B.

Production thinking

Take this beyond the example.

Protect reads, writes, counts, exports and errors that reveal resource existence. Test permitted, unauthenticated, denied-role, stale-session and foreign-tenant paths separately.

Sources and further reading

Your evidence

unseen is a local learning signal, not a credential or proof of production competence.

Explain the mental model, then explicitly acknowledge it. Opening a page is not evidence.

Supported retries can complete this lesson. Independent evidence and delayed review determine the skill stage.

Next lesson · Give each browser defense its own job →