Broken Access Control

The video discusses the risks of unauthorized access to resources like web pages and databases without proper authentication. It highlights the issue of developers restricting access only on the UI side, neglecting server-side security, which can lead to attackers gaining admin rights. To prevent broken access control, it is crucial to invalidate tokens and cookies after logout, enforce login/logout after password changes, and secure resources on the server side.

What types of resources can be accessed without proper authentication?

• Only web pages

• Web pages, databases, and directories

• Only databases

• Directories and images

Which of the following is a common problem developers face regarding access control?

• Neglecting server-side restrictions

• Restricting access on both UI and server side

• Using outdated authentication methods

• Providing too many user accounts

What can happen if server-side restrictions are neglected?

• Users can only access their own data

• Attackers can gain admin rights

• The application becomes faster

• Users are logged out automatically

Which of the following is a recommended practice to protect against broken access control?

• Securing only the UI interface

• Keeping tokens active indefinitely

• Allowing password changes without logout

• Invalidating tokens and cookies after logout

Why is it important to enforce login/logout after a password change?

• To improve user experience

• To ensure the user remembers their password

• To prevent unauthorized access with old credentials

• To reduce server load