What is the best protection against Privilege Escalation vulnerability in web application. Basically I am able to change the HTTP response in JSON format from USER ID to ADMIN ID to get access to the admin account system.
closed as unclear what you're asking by Dog eat cat world, Ohnana, WhiteWinterWolf, Neil Smithline, schroeder♦ Jan 19 '16 at 23:53
Please clarify your specific problem or add additional details to highlight exactly what you need. As it's currently written, it’s hard to tell exactly what you're asking. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.
In kind of security you talk generally of 3 points:
You are missing point 2/"never trust the client": You identify the client by the ID and give him the rights based on the ID sent from the client. Like you saw this fails because the client can lie. The most common solutions for authentification at websites are:
- Sending an authentification token like a password with the request AND CHECKING SERVERSIDE
- Using sessions (like cookies) AND CHECKING SERVERSIDE