Prepare two isolated test accounts
Create account A and account B with ordinary permissions. If your product supports organizations, place them in separate organizations and create recognizable test records in each.
Use test data only and work within systems you own or are authorized to assess.
- Create records in both accounts
- Include parent and child resources
- Record each account and organization identifier
- Avoid real customer records
Replay identifiers across accounts
While authenticated as account B, replace a project, invoice, file or user identifier with the corresponding value from account A. Test the API request directly rather than only changing a page URL.
Repeat this for read, update, delete and action endpoints. Export, share and download endpoints are commonly overlooked.
- GET another account’s record
- Update a writable field
- Attempt deletion
- Try export, download and share routes
- Test list endpoints with altered filters
Check nested and indirect authorization
An endpoint may verify access to a project but forget to verify that a supplied task actually belongs to that project. Background jobs and webhooks can contain the same mistake.
The safe pattern is to resolve resources through the authorized parent or apply an ownership condition in the data query.
- Mix parent and child IDs from different accounts
- Test invitation acceptance
- Test file paths and signed links
- Check asynchronous jobs triggered by user input
Fix the server boundary, not the screen
Hiding navigation or disabling a button does not enforce authorization. Every sensitive server operation should derive identity from the authenticated session and verify permission against the target resource.
After fixing one endpoint, search for sibling routes built from the same pattern and add regression tests.
- Add negative authorization tests
- Return a consistent 403 or 404 response
- Avoid trusting owner IDs supplied by the browser
- Review similar endpoints for the same flaw
Authoritative references
Have experienced reviewers test the real application.
AuditFlare validates findings across your product, code and business logic, then explains what to fix.
Explore the web app security audit →