Access-control failures can expose records or functions to users who should not reach them. Developers and testers examine direct object references, presentation-layer controls, and function-level authorization, then consider data- and function-level checks that keep access tied to the right user and role.

Participants of this module will…

• Learn about the dangers of relying on presentation -layer access control
• Obtain strategies to implement function-level access control
• Learn about the dangers of direct object references
• Obtain strategies to implement data-level access control