Access Denied
Decide which roles may perform each action, then defend your permission matrix against tricky requests.
This challenge builds on the Authentication & Authorization lab. You can start right away, or open the lab first.
Open the Authentication & Authorization labNot started
An unfinished attempt isn't saved. Reloading the page starts it again; only completion is remembered, and only on this device.
Scenario
Incident at Papertrail
Papertrail is a fictional team notes app with three roles: Admin, Editor and Viewer. A security review found four requests that the server answered with 200 OK and should have refused. The access rules were written in a hurry, and the interface hides some buttons, which stops nobody from sending a request directly.
Find what is wrong in the server's rules and fix it, without locking out people who should have access.
Your objectives
- Remember that being signed in (authentication) doesn't grant every action.
- Treat a hidden button as a convenience, never as a security boundary.
- Check permissions on the server, for every request.
- Deny by default when the permission is missing.
- Tell apart an invalid session (401) from insufficient permission (403).
Everything here is fictional and runs in your browser. No real accounts, secrets or network requests are involved.