Haxoris Wiki

Client-Side Only Authorization

How Client-Side Only Authorization works

If the app enforces roles/permissions only on the client (e.g., hiding admin features) and the backend does not verify authorization for each request, attackers can manipulate API calls to access protected resources.

Client-Side Only Authorization in practice

Toggle Privileged Flags in Requests

Intercept with a proxy and modify parameters:

mitmproxy  # capture a normal request
# Change fields like {"is_admin":false} -> true or alter userId in path
curl -H "Authorization: Bearer <TOKEN>" -X POST \
  https://api.example.com/admin/users/123/disable

If the backend accepts the request without server‑side checks, authorization is broken.

How to fix and prevent Client-Side Only Authorization

  1. Enforce authorization server‑side
    • Evaluate user roles/ownership on every request; ignore client flags.
  2. Defence in depth
    • Sign sensitive parameters, bind to session, and validate with HMACs where appropriate.
  3. Logging and detection
    • Alert on privilege‑escalating actions and mismatched user identifiers in requests.

Last updated

References