QA Fundamentals · Middle · Question 46 of 75

What is a typical check for broken access control?

1Checking that admin pages have a different colour
2Measuring how quickly the admin panel loads
3Calling an admin API with a regular user's token

Show the answer

Correct answer: Calling an admin API with a regular user's token

Explanation

Hiding a button in the UI isn't protection. The server must reject requests from users without the right role or ownership.

Further reading

Test yourself

Take the QA Fundamentals · Middle quiz: questions and options are shuffled, and you get a review of your mistakes at the end.