API Testing · Middle · Question 23 of 75
How do you systematically test object-level authorization?
- 1Check that IDs in the URL are long and hard to guess
- 2Log in as an admin and check that every object can be read
- 3Create data as user A and try every operation on it as user B
Show the answer
Correct answer: Create data as user A and try every operation on it as user B
Explanation
Read, update, delete and nested resources should all deny user B. Unguessable IDs help but don't replace checks.