Chapter 6: Broken Access Control
Authorization is just as significant and essential as authentication. It defines what an authenticated user can perform and execute, and resources and web pages need to have defined privileges to limit unauthorized access. Permission bypass and missing or improper access controls are some of the broken access control vulnerabilities discovered in an ASP.NET Core web application.
In this chapter, we're going to cover the following recipes:
- Fixing insecure direct object references (IDOR)
- Fixing improper authorization
- Fixing missing access control
- Fixing open redirect vulnerabilities
By the end of this chapter, you will have learned how to use the built-in authorization mechanism in ASP.NET Core. You will properly implement role-based authorization to prevent unauthorized access to resources in your web application. Also, you will see how to utilize safer redirection methods to prevent open redirection attacks.
