-1
votes
2answers
118 views

Is there a difference between Broken Access Control and Insecure Direct Object reference? [closed]

According to me,if this difference is correct,it is that for exploiting a broken access control you don't necessarily need to be logged into the application,but for exploiting insecure direct object ...
3
votes
2answers
372 views

Is there a spreadsheet/template for Mapping WebServices Authorization Rules?

I'm looking for a spreadsheet/template that allows the business-rules (i.e. 'who has access to what') to be mapped, visualized and analyzed. In the past I have created a couple of these (some even ...