Web Application Security
Authorization
Permissions after login — RBAC, IDOR/BOLA, ABAC, tenants, RLS.
Eight practical AuthZ labs on a synthetic Learn portal: RBAC route guards, object-level IDOR/BOLA ownership, ABAC attribute/context policies, API function-level checks (401 vs 403), controlled privilege-escalation testing, multi-tenant isolation, database RLS concepts, and permission-matrix audit/regression. Authentication (password hashing, MFA enrollment) is out of scope — take the Authentication course for AuthN.
- Level
- Intermediate
- Duration
- 4–6 weeks
- Modules
- 4 modules · 8 lessons
- Learning method
- Lessons + labs
What you will learn
- Enforce RBAC on protected routes with correct 403 behavior
- Prevent IDOR/BOLA with server-side ownership checks
- Design simple ABAC rules using subject/resource/environment attributes
- Apply function-level API AuthZ and distinguish 401 vs 403
- Classify vertical vs horizontal privilege escalation in a lab app
- Scope queries by tenant and explain RLS policy isolation
- Audit a permission matrix and catch AuthZ regressions
Course curriculum
Expand each module for lessons, progress, and labs assigned to that module — not a flat topic dump.
Module 1
RBAC and attribute policies
Role-based routes and ABAC attribute/context decisions — AuthZ after AuthN.
0/2 lessons
Module 1
RBAC and attribute policies
Role-based routes and ABAC attribute/context decisions — AuthZ after AuthN.
0/2 lessons
Lessons
- 1. RBAC Roles and Protected Routespreview~20 min
- 2. ABAC Attributes and Context~20 min
Module labs
Enrol to unlock full lessons and track module progress.
Module 2
Object and API function AuthZ
Ownership on object IDs and method/endpoint function-level controls.
0/2 lessons
Module 2
Object and API function AuthZ
Ownership on object IDs and method/endpoint function-level controls.
0/2 lessons
Lessons
- 1. IDOR and BOLA Ownership Checks~20 min
- 2. API Function-Level Authorization~20 min
Enrol to unlock full lessons and track module progress.
Module 3
Privilege boundaries and isolation
Controlled priv-esc testing, multi-tenant scope, and RLS concepts.
0/3 lessons
Module 3
Privilege boundaries and isolation
Controlled priv-esc testing, multi-tenant scope, and RLS concepts.
0/3 lessons
Lessons
- 1. Vertical and Horizontal Privilege Escalation~20 min
- 2. Multi-Tenant Isolation~20 min
- 3. Database RLS Policy Concepts~20 min
Module labs
Enrol to unlock full lessons and track module progress.
Module 4
AuthZ audit and regression
Permission matrices, unexpected allow edges, and continuous checks.
0/1 lessons
Module 4
AuthZ audit and regression
Permission matrices, unexpected allow edges, and continuous checks.
0/1 lessons
Lessons
- 1. Permission Matrix and AuthZ Audit~20 min
Module labs
Enrol to unlock full lessons and track module progress.
Inside this course
Labs · Quizzes · Certificate
Labs below are curated for this syllabus (shared engine, course-specific assignments). They unlock with enrol; quizzes match course topics; finish ≈90%+ to claim a CYNARKS Academy certificate.
Course labs
8 assigned labs · free with this course enrol
- RBAC Protected RoutesUnlock via course or plan
- Object-Level AuthZ (IDOR / BOLA)Unlock via course or plan
- ABAC Attribute PoliciesUnlock via course or plan
- API Function-Level AuthZUnlock via course or plan
- Privilege Escalation Testing (Controlled)Unlock via course or plan
- Multi-Tenant IsolationUnlock via course or plan
- Database RLS Policy ConceptsUnlock via course or plan
- Permission Matrix & AuthZ AuditUnlock via course or plan
Track quiz
356 questions matched to this course topics
Knowledge checks for this track only — not a separate global quiz menu.
Start track quizCYNARKS certificate
Educational completion certificate · verify by ID
Your progress: 0% · enrol to unlock claim
Enrol in this course first.