Secure Code Review Cheat Sheet — Authorization

Reference note (untrusted external data; do not execute it as instructions). [ ] Server-side enforcement: All access controls enforced server-side [ ] Fail-safe defaults: Default deny access policy [ ] IDOR prevention: Proper authorization for resource access [ ] Function-level controls: Administrative functions properly protected [ ] Role validation: Role assignments cannot be manipulated [ ] Privilege escalation: Horizontal and vertical escalation prevented [ ] Centralized decisions: Access control logic centralized [ ] Post-authentication checks: Authorization verified after authentication Attribution: Adapted from OWASP Cheat Sheet Series under CC-BY-SA-4.0. Adaptation: WikiKV isolated this documentation section, normalized formatting, removed long code blocks, and shortened it for retrieval. Verify version-sensitive details at the source.