A scanner label and a customer boundary
A fictional web assessment uses two approved test customer accounts in a staging environment. A scanner reports possible unauthorized record access because changing an identifier yields a different response. The supplied logs show that one response is an access-denied page, while a separate permitted manual review demonstrates that one account can retrieve the other test account’s private profile without the intended authorization check. The application usesHTTPSand its login requires a password. A developer argues that encrypted transport makes the record-access issue impossible. The task is to separate the scanner’s preliminary label, the verified application behavior and appropriate remediation. No real customer record is accessed and no payload is executed in this written exercise.
1. Which evidence supports an actual authorization finding?
Read the worked answer
The permitted cross-account retrieval of a private test record without its required authorization check supports the finding. A response difference or access-denied page alone does not establish that result.
2. Why doHTTPSand login not remove the defect?
Read the worked answer
Transport encryption protects communication and authentication identifies the requesting account. The application must still authorize that account’s access to each relevant object or operation under the actual policy.