Authorization

Authorization is separate from authentication. Authentication verifies who an entity is; authorization verifies that a requested action or service is approved for that entity. An authenticated user is often not authorized for every action a system allows, as when administrators can do things regular users cannot, and an unauthenticated user may still be authorized to reach public resources such as a login page.

Systems make authorization decisions with access control models. Role-based access control (RBAC) grants or denies access based on the roles assigned to a user. Attribute-based access control (ABAC) decides on attributes of the subject and the object, environment conditions, and a set of policies. Relationship-based access control (ReBAC) grants access based on relationships between users and resources, such as letting only the author of a post edit it.

OWASP guidance for applications is to enforce least privilege, deny access by default, and validate permissions on every request. An application must always decide to permit or deny a request, so when no rule explicitly matches, access should be denied.

Authorization flaws can let attackers read, create, modify, or delete resources that were meant to be protected. Broken access control holds the first position in the OWASP Top 10 for 2025, and every application tested for that edition had some form of it. Horizontal privilege escalation, where a user reaches another user's resources, is an especially common weakness.