The Web Application Hacker’s Handbook Discovering and Exploiting Security Flaws

Chapter 8 

■

Attacking Access Controls  231

70779c08v6.5.qxd  9/14/07  3:18 PM  Page 231

---

Figure 8-1:  Example of a privilege matrix for a complex application

Within a security model of this kind, you can see how various useful access

control concepts can be applied:

■■

Programmatic control —

The matrix of individual database privileges

is stored in a table within the database, and applied programmatically

to enforce access control decisions. The classification of user roles pro-

vides a shortcut for applying certain access control checks, and this is

also applied programmatically. Programmatic controls can be extremely

fine-grained and can build in arbitrarily complex logic into the process

of carrying out access control decisions within the application.

■■