Authorization is the process of deciding what an identified user, device or application is allowed to do – which data it may read, which actions it may perform and which resources it may access.
How authorization works
Authorization comes after authentication: authentication answers “who are you?”, authorization answers “what are you allowed to do?”. Systems enforce it through access control models:
- Access control lists (ACLs) – permissions attached to each file or object;
- Role-based access control (RBAC) – rights assigned to roles such as “accountant” or “helpdesk”;
- Attribute-based access control (ABAC) – decisions based on attributes like department, device state, location or time;
- Relationship-based access control – used by cloud services to share documents with specific people.
On the web, OAuth 2.0 (RFC 6749) is an authorization framework: it lets a user grant an application limited access to their data without sharing the password, using access tokens with defined scopes.
Why authorization matters
Authorization flaws are among the most common serious vulnerabilities. “Broken access control” is ranked first in the OWASP Top 10 (2021), and broken object level authorization (BOLA) tops the OWASP API Security Top 10. The weaknesses are catalogued as CWE-862 (missing authorization) and CWE-863 (incorrect authorization). A typical example is an insecure direct object reference: changing an ID in a URL reveals another customer’s invoice. Such bugs have exposed millions of records, and flaws that let users perform admin functions lead directly to privilege escalation.
Best practices
- Check permissions on the server for every request, never only in the user interface.
- Deny by default and follow the principle of least privilege.
- Centralise authorization logic and review roles and permissions regularly.
- Include access control cases in automated tests and penetration tests.
