Detects missing ownership checks, broken role enforcement, and IDOR vulnerabilities that let users access other users' resources. Use when writing code that checks authorization, enforces resource ownership, handles IDOR (object-level authorization), processes server-side requests to external URLs, or implements access control middleware.
설치
Codex 또는 Claude로 설치 이 Prompt를 복사해 Codex, Claude 또는 다른 어시스턴트에 붙여 넣으면 Skill 페이지를 검토하고 설치를 진행할 수 있습니다.
Detects missing ownership checks, broken role enforcement, and IDOR vulnerabilities that let users access other users' resources. Use when writing code that checks authorization, enforces resource ownership, handles IDOR (object-level authorization), processes server-side requests to external URLs, or implements access control middleware.
Broken Access Control Security Check (A01:2025)
What this checks
Protects against unauthorized resource access caused by missing ownership checks or
role enforcement. Exploitation leads to horizontal/vertical privilege escalation.
For SSRF (server-side request forgery), see the dedicated ssrf skill.
Vulnerable patterns
Resource lookup by caller-supplied identifier with no ownership predicate before the row is returned, mutated, or acted on
Privileged or admin route mounted with no role check at the route/controller declaration
Ownership check that runs after the resource has already been fetched and consumed by downstream logic
Ownership failure that responds with a distinct "forbidden" status, leaking that the resource exists
Fix immediately
Flag the vulnerable code and explain the risk. Then suggest a fix that establishes
these properties:
Every resource lookup by caller-supplied identifier is gated before the resource
is returned, mutated, or acted on. The gate binds the row to the authenticated
caller — an ownership predicate for per-instance access, or a role predicate for
role-scoped access. The check can live in a handler, interceptor, filter, annotation,
decorator, or middleware — anywhere, as long as it runs before the data is used.
Privileged routes enforce role membership through a reusable, centrally-declared
mechanism (middleware, filter chain, annotation, decorator, policy) attached at
the route or controller declaration. Ad-hoc if role != "admin" checks inside
handler bodies are brittle — they can be forgotten on a new route and they're
invisible at a glance.
Ownership failures return an indistinguishable "not found" response (HTTP 404).
Returning 403 leaks that the resource exists. Role-missing failures on a privileged
route may still return 403 — the route itself is public knowledge, so only the
instance-level check needs to hide behind 404.
Translate these principles to the audited file's language and framework. Use the
documented authorization or policy mechanism for that stack; do not invent ad-hoc
checks in handler bodies.
Verification
Confirm these properties hold (language-agnostic):
Every resource lookup by caller-supplied identifier is gated by an ownership or role predicate before the resource is returned, mutated, or acted on — regardless of whether the check lives in a handler, interceptor, filter, annotation, decorator, or middleware
Privileged routes enforce role membership through a reusable, centrally-declared mechanism (middleware, filter chain, annotation, decorator, policy) attached at the route/controller declaration — not via ad-hoc if checks inside individual handler bodies
Ownership (per-instance IDOR) failures return an indistinguishable "not found" response (e.g. HTTP 404) rather than a distinct "forbidden" response, to prevent resource enumeration. Role-missing failures on a privileged route may use 403 because the route itself is public knowledge
