8000 Improve the AuthZ/AuthN rationale by loris-s-sonarsource · Pull Request #67 · OWASP/www-project-mobile-top-10 · GitHub
[go: up one dir, main page]
More Web Proxy on the site http://driver.im/
Skip to content
8000

Improve the AuthZ/AuthN rationale #67

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 1 commit into
base: master
Choose a base branch
from
Open

Improve the AuthZ/AuthN rationale #67

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 7 additions & 1 deletion 2023-risks/m3-insecure-authentication-authorization.md
8515
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -55,7 +55,13 @@ The business impact of poor authentication and authorization will typically resu

# Am I Vulnerable To 'Insecure Authentication / Authorization'?

Understanding the difference between authentication and authorization is paramount in evaluating mobile application security. Authentication identifies an individual, while authorization verifies if the identified individual has the necessary permissions for a particular action. These two aspects are closely related, as authorization checks should immediately follow mobile device request authentication.
Understanding the differences between identification, authentication, and authorization is paramount when evaluating mobile application security.

* **Identification** is the process of determining who the user or entity is.
* **Authentication** involves verifying whether the user or entity is genuinely who or what they claim to be.
* **Authorization**, on the other hand, is the process of confirming whether the identified individual has the necessary permissions to perform a specific action.

These aspects are closely related. Authorization checks should immediately follow the authentication of a mobile device request, which is often combined with the identification process.

Insecure authorization can occur when an organization fails to authenticate an individual before executing a requested API endpoint from a mobile device, as it is virtually impossible to conduct authorization checks on an incoming request without an established caller's identity.

Expand Down
0