Access control is the decision about who may do what, and it breaks when the server trusts the request or forgets to check at all. This set checks that you can spot a missing check and know what a check that denies by default looks like.
Each one is marked as you go, and the explanation arrives straight after, which is
the part worth reading.
4 questions, marked as you go.
Tasks
These need your own device. Run the command in Termux, then paste what it printed.
The marking looks at what the output means, so spacing, version numbers and
ordering do not matter. If you have not installed anything yet, the
lesson covers the setup.
Hand a record to the wrong caller, then refuse it
This models one request: caller 1 asks for record 2, which belongs to someone else. It prints the request, what the flawed code returns, and what a check that denies by default returns. Run it and paste all three lines.
Run this in Termux
On your own device. Nothing on this page executes it. The command runs in
your terminal, and this box only reads what you paste back.
python3 -c "users={'1':'ada','2':'grace'}; caller='1'; role='user'; target='2'; print('caller', caller, 'asks for record', target); print('flawed :', 'returns '+users[target]); print('fixed :', users[target] if (role=='admin' or caller==target) else '403 forbidden')"
Three lines should come back: the request, a record handed over, and a refusal.
the flawed code handed over another user record
the fixed check refuses the request
the request names a caller and a record that is not theirs
the command actually ran
What a good answer looks like
Three lines. The first names the caller and the record, and they do not match. The flawed line returns grace, which is another user record handed over with no check. The fixed line reads 403 forbidden, because the caller is not the owner and is not an admin, so the check refuses. The same request produces a leak in one version and a refusal in the other, and the only difference is the check.
Marking your own work
Both halves of this are checked in your browser, with no server involved, so nothing
stops you from pasting output you did not run. The tasks are written so that the
easiest way to pass one is to actually do it and read the result, which is the whole
intention.