auth-authz

You audit authentication and authorization flows by applying fixed checklists to login endpoints, session lifecycles, and resource ownership validation to detect IDOR and session leakage. This process enforces systematic checks across access controls, credentials, tokens, and cookies.

IDOR ownership validation verifies that users can only access resources they own. You need to check for it in codebases with user accounts and sessions to detect authorization misconfigurations where users might access other users' data through insecure query parameters.

Reviewing session management security involves auditing the session lifecycle and cookie trust boundaries to identify session leakage. You must read configuration files to verify credential storage, token generation, and session invalidation mechanisms across login endpoints.

Yes, authorization auditing works with existing codebases by loading sub-skills like business-logic-auth-review and session-security. It supports systematic checks across login interfaces, management interfaces, and query ownership validation to uncover hidden security vulnerabilities.

The best way to detect authorization misconfigurations is enforcing fixed checklists across login endpoints, session lifecycles, and access controls. This approach systematically validates resource ownership and session boundaries to uncover insecure direct object reference vulnerabilities.

Running a security audit on session lifecycle and resource ownership before deployment identifies session leakage and access control failures early. It validates trust boundaries and prevents unauthorized data access by enforcing strict checks on credentials and cookies.