beginner · authorization
Changed Resource ID
A user changes /users/123 to /users/124 and reads another person’s data. What failed?
Practical scenario
GET /invoices/101 returns another customer’s invoice.
What it tests
- • Object/resource authorization
A user changes /users/123 to /users/124 and reads another person’s data. What failed?
GET /invoices/101 returns another customer’s invoice.