Web Application Security, A Beginner's Guide

Access Control Overview

For many web applications, it’s important that only certain users be permitted to access protected resources. A subscription-based online newspaper (for example, The New York Times) might only want the headline articles to be freely available while the rest of its content is accessible only to paying customers. Enforcing this kind of control means that you need to have a strong access control system.

Formally defined, an access control system is a mechanism that regulates access to data or functionality by determining whether a subject is permitted to perform an operation on a target object. Informally, an access control mechanism determines whether Joe User (our subject) is allowed to view (an operation) the current balance ...