Chapter 1 of 7 · 3 practices · 3 min · 3-question quiz
Deny by default, check on the server
The three rules every other practice builds on: nothing is allowed unless a rule says so, the check runs on the server for every request, and an error means no.
Start: Deny by default and require an explicit allow3 practices in this chapter
- 1Deny by default and require an explicit allowOWASP's Authorization Cheat Sheet says an application "should be configured to deny access by default", and the Top 10:2025 lists "deny access by default, except for public resources" first among its…
- 2Check authorization on the server for every requestASVS 5.0 requirement 8.3.1 says authorization rules must be enforced in a trusted service layer, not in controls the client could manipulate, such as JavaScript in the browser. OWASP's cheat sheet…
- 3Grant the least privilege and fail closed on errorsLeast privilege means each user, service and API key gets only what its job needs. OWASP applies it "both horizontally and vertically": horizontally across peers (a user sees their own records, not a…
Check yourself on this chapter
3 questions, right here once you are signed in. Your progress is saved as you read.