Introducing Test Roles for Authorization Testing with Akto

Introduction

In API security, authorization tests involve checking if the access control measures in place are working effectively. This includes verifying if API endpoints are correctly granting or denying access based on the authorization token provided. These tests ensure that users can only access data and perform actions that their specific role allows, preventing unauthorized access and protecting sensitive information, and avoid cases like how there were IDOR vulnerabilities found in Microsoft Teams.

For example, a generic user of your application should not be able operate administrator, manager or staff functions. So it’s important for you to test for the eventuality of this vulnerability by using the authorization tokens of different ‘roles’, and you can do this with Akto.

What are ‘Roles’ in Authorization Testing?

'Test Roles' in authorization tests refer to the different types of users that a system may recognize. These roles often come with different levels of access and privileges. For example, in a retail system, the roles might include 'admin', 'staff', and 'customer'. An 'admin' might have full access to all system functions, while 'staff' might only have access to a subset of these functions. A 'customer', on the other hand, will typically have the most restricted access, limited to only those functions necessary for making purchases.

By testing with different roles, you can ensure that the application correctly enforces these access restrictions.

Authorization Testing with Roles in Akto

Authenticated Scanning

Authenticated scanning involves testing the application while logged in as a user. When testing as an 'admin' role, this allows you to access and test all parts of the system. This is crucial as it allows for a comprehensive assessment of the system's security, including areas that may not be accessible to lower-level roles. It helps identify vulnerabilities that could be exploited if an attacker managed to gain 'admin' level access. However, it's important to also test other roles to ensure that they don't have more access than they should, and you can do it with Akto!

Privilege Escalation

Privilege escalation is a type of security vulnerability where a user gains access to resources or performs actions outside of their designated privileges. It often occurs when a system fails to properly authenticate a user's permissions, allowing them to gain a higher level of access than intended, like Toyota’s API Security breach for example.

In the context of securing your APIs, you can use different 'roles', such as 'admin', 'customer', etc., to check for privilege escalation issues. For instance:

1. You could perform tests using the authorization token of a 'customer' role to try accessing resources or performing actions that should only be available to an 'admin' role.

2. If the 'customer' role can successfully perform these 'admin' actions, then a privilege escalation issue is present.

Other examples of vulnerable cases -

1. Customer could operate manager or staff functions (Or administrator functions as seen above)

2. Staff user could operate manager or administrator functions;

3. Manager could operate administrator functions.

This type of testing is crucial to ensure that proper access control measures are enforced and that users cannot exceed their intended privileges. You can use Akto to scan for all these types of privilege escalation issues!

Automated Auth Token creation with Akto

Auth tokens can have varying expiry times depending on the API security measures in place. Some tokens may only last for a short duration like 15 days, while others might be set to expire in 6 months. This variability can pose a challenge when conducting regular API security testing, as outdated tokens can disrupt the testing process.

However, Akto provides a solution to this problem by allowing you to automate your auth token generation. This means you can always have a valid token ready for your API security testing, regardless of the original token's expiry date, making the process more efficient and hassle-free.

Create a User Role in Akto for Testing

Akto allows you to check for authorization vulnerabilities through the following steps:

Step 1: Create a Test Role

Go to the Test Roles tab under Testing in the left navigation.