authz-check

What problem does it solve?

Prevents unauthorized access to user data by ensuring that endpoints check for both authentication and ownership.

Core Features & Use Cases

• Ownership Verification: Checks if the current user is allowed to access the specific record.
• IDOR Protection: Tests for Insecure Direct Object References by swapping IDs to see if data is leaked.
• Admin Actions: Ensures server-side checks for admin or privileged actions.
• Default Deny: Recommends requiring explicit authorization for new endpoints.
• Use Case: For an endpoint like "get user X's data", this skill ensures that the current user is indeed the owner of the data they are trying to access.

Quick Start

Use the authz-check skill on a new endpoint to verify ownership checks are in place.