Web Security · Middle · Question 60 of 75

What is the difference between RBAC and ABAC?

✓Correct answer: RBAC grants permissions by role; ABAC decides using attributes of the user, resource and context
2RBAC is for APIs, ABAC is for web pages
3They are two names for the same model

Explanation

"Editors can edit articles" is RBAC. "Editors can edit articles in their department during work hours" needs attributes.

Further reading

OWASP: Authorization Cheat Sheet ↗

Test yourself

Take the Web Security · Middle quiz: questions and options are shuffled, and you get a review of your mistakes at the end.