What is the best protection against Privilege Escalation vulnerability in web application. Basically I am able to change the HTTP response in JSON format from USER ID to ADMIN ID to get access to the admin account system.
In kind of security you talk generally of 3 points:
You are missing point 2/"never trust the client": You identify the client by the ID and give him the rights based on the ID sent from the client. Like you saw this fails because the client can lie. The most common solutions for authentification at websites are:
- Sending an authentification token like a password with the request AND CHECKING SERVERSIDE
- Using sessions (like cookies) AND CHECKING SERVERSIDE