build1 publisher
A normal user reached an RBAC app's admin functions through a route the server never checked
A reviewer with eight years' experience reached a restaurant app's admin functions from his non-admin session because its endpoints never checked his role. The app was built with RBAC middleware, but the role check ran only in the browser.
Publishers:dev.to
Reality
- Evidence35
- Adoption
- Insufficient
- Hype gap0
- Incentives
- Insufficient
- Confidence40