Even when authentication works correctly, APIs can still expose data or actions to the wrong users if authorization checks are weak. Authorization testing verifies that permissions are enforced consistently across endpoints, roles, and tenants. This is crucial for preventing horizontal and vertical privilege escalation.
Role-Based and Attribute-Based Access
Many systems use role-based access control (RBAC), where roles like admin, manager, and user have different permissions. Others use attribute-based access control (ABAC), combining attributes such as department, region, or subscription level. Testers should understand the policy model to design effective authorization tests.
# Example authorization test ideas
- Regular user cannot access admin-only endpoints.
- User A cannot view or modify User B's resources.
- Cross-tenant access is blocked in multi-tenant systems.
- Admin actions are logged and restricted to appropriate roles.Authorization tests should include both vertical checks (ensuring lower-privilege users cannot perform higher-privilege actions) and horizontal checks (ensuring users cannot access other users’ data). In multi-tenant systems, verify that data does not leak between tenants through identifiers or filters.
Systematic Authorization Testing
Approaches include designing decision tables for permissions, using pairwise combinations of roles and actions, and including authorization checks in regression suites. Automation can significantly increase coverage by exercising many combinations quickly.
Common Mistakes
Mistake 1 — Testing authorization only through the UI
Attackers bypass the UI and call APIs directly.
❌ Wrong: Assuming that hiding buttons is enough to prevent actions.
✅ Correct: Call APIs directly with different roles and verify server-side checks.
Mistake 2 — Not testing cross-user and cross-tenant access
These scenarios are a common source of data leaks.
❌ Wrong: Only testing access to your own resources.
✅ Correct: Attempt to access other users’ or tenants’ resources and ensure they are blocked.