Access Control

Lab: User ID controlled by request parameterLab: Unprotected admin functionalityLab: Insecure direct object referencesLab: Multi-step process with no access control on one stepLab: Referer-based access control
PreviousLab: 2FA simple bypassNextLab: User ID controlled by request parameter