Authorization boundaries end to end
On This Lesson 4 topics
This lesson is planned. The outline below lists the topics it will cover. The full lesson has not been published yet.
In this lesson
verify that every path to data checks who may do what.
Planned topics
- Authentication says who; authorization says what they may do on which object.
- Check each path: public API, internal service calls (do not trust a call merely because it is internal), message consumers, batch jobs, admin tools, direct database access.
- Common failures: object-level access (change an ID and see another customer's order), missing checks on internal endpoints, over-broad service credentials, confused deputy.
- Propagate identity and enforce at the data layer; test negative cases.
Draft outline details
Demonstration
Matrix: path | caller identity | check performed | where enforced | test. Example row: GET /orders/{id} | customer token | order.customerId equals subject | orders service | cross-customer test.
Check your understanding
Why test by changing an object ID?
Show answer
To detect missing object-level authorization.
Practice
Apply this lesson with the module's lab, exercises and quiz.
Marking a lesson complete is optional and you can undo it any time. Your progress stays in this browser.