Skip to content

Fixes #123 Adding SCP [85, 86, 89, 90, 91, 93, 100] Cornucopia - Access Control #124

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
sydseter merged 3 commits into from
Jul 3, 2025
Merged

Fixes #123 Adding SCP [85, 86, 89, 90, 91, 93, 100] Cornucopia - Access Control #124

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
04b2ce9
Fixes #123 Adding SCP [85, 86, 89, 90, 91, 93, 100] Cornucopia - Acce…
sydseter Jul 2, 2025
3f19cfb
Fixes #123 Adding words to wordlist
sydseter Jul 2, 2025
9fc6ada
Merge branch 'main' into 07-access-controls
sydseter Jul 3, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 2 additions & 0 deletions .wordlist-en.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -530,3 +530,5 @@ Amauri
Bizerra
Ebihara
Yuuki
BOPLA
BOLA
16 changes: 16 additions & 0 deletions docs/en/04-design/02-web-app-checklist/07-access-controls.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,6 +12,11 @@ and use the list below as suggestions for a checklist that has been tailored for
3. Deny by default; if a request is not specifically allowed then it is denied
4. Apply least privilege, providing the least access as is necessary
5. Log all authorization events
6. Create unit and integration test to document and verify an application's business rules, data types and access
authorization criteria and/or processes so that access can be properly provisioned and controlled for restricting
function-level, data-specific, and field-level access based on consumer permissions and resource attributes
7. Access Control criteria and/or processes not testable through automated tests should be documented so that they
can be manually tested

#### 2. Access control

Expand All @@ -26,6 +31,17 @@ and use the list below as suggestions for a checklist that has been tailored for
8. If long authenticated sessions are allowed, periodically re-validate a user's authorization
9. Implement account auditing and enforce the disabling of unused accounts
10. The application must support termination of sessions when authorization ceases
11. Restrict function-level access to consumers with explicit permissions
12. Restrict direct object references to only authorized users with explicit permissions to specific data items
to mitigate insecure direct object reference (IDOR) and broken object level authorization (BOLA)
13. Restrict access to user and data attributes to consumers with explicit permissions to specific fields to mitigate broken
object property level authorization (BOPLA)
14. Restrict access security-relevant configuration information to only authorized users who have been allowed access through
multiple layers of security, including continuous consumer identity verification, device security posture assessment, and
contextual risk analysis
15. Server side implementation and presentation layer representations of access control rules should not differ in such a way
that they allow for business functionality and rules to be compromised
16. Enforce application logic flows to comply with business rules

#### References

Expand Down