Authorization and access control ensures that your users can only access resources they’re permitted to use in a web application. Common vulnerabilities include directory traversal, insecure direct object reference, bypassing authorization mechanisms, and privilege escalation.
Understand User Roles and Access Control
User roles help in managing access rights and other privileges for your web applications.
Unauthenticated users can access only the login page.
Regular users can use most parts of the application but can’t access areas such as maintenance or setup pages.
Administrators have full access, including to the restricted areas of the application.
Sometimes users can gain unauthorized access, called an authorization bypass. A specific type of authorization bypass, called privilege escalation, happens when a user with limited access gains permissions for a higher-level role, like an administrator. This authorization bypass can result in access to sensitive or restricted features.
Implement secure coding practices in Apex and Visualforce by enforcing object-level, field-level, and record-level access controls to prevent unauthorized data exposure or manipulation. Follow your organization’s security policy on both standard and custom objects while ensuring that your app adapts to users with limited access.
j