The Web Application Hacker’s Handbook Discovering and Exploiting Security Flaws

Role-based access control (RBAC) —

There are named roles, which

contain different sets of specific privileges, and each user is assigned to

one of these roles. This serves as a shortcut for assigning and enforcing

different privileges and is necessary to help manage access control in

complex applications. Using roles to perform upfront access checks on

user requests enables many unauthorized requests to be quickly

232

Chapter 8 

■

Attacking Access Controls

70779c08v6.5.qxd  9/14/07  3:18 PM  Page 232

---

rejected with a minimum amount of processing being performed. An

example of this approach is in protecting the URL paths that specific

types of user may access.

When designing role-based access control mechanisms, it is necessary to

balance the number of roles so that they remain a useful tool to assist in

the management of privileges within the application. If too many fine-

grained roles are created, then the number of different roles becomes

unwieldy, and they are difficult to manage accurately. If too few roles are

created, the resulting roles will be a coarse instrument for managing

access, and it is likely that individual users will be assigned privileges

that are not strictly necessary for performance of their function.

■■