Authorization Testing

Matrices, object discovery, policies, semantic analysis, safe writes, GraphQL, WebSocket, findings, protected evidence, and retesting.

Authorization Testing

The Electron + Go edition turns identity comparison into a policy-aware workflow with bounded discovery, protected evidence, and repeatable findings.

Authorization Matrix

Test anonymous, User A, User B, and Admin against the same endpoint automatically. The matrix records status, response behavior, identity alias, and policy outcome for every access context.

Object-ID Discovery

Object candidates can come from:

  • URL paths such as /users/123/orders/456;
  • query values such as ?account_id=123;
  • JSON fields such as {"document_id":"abc"};
  • GraphQL variables;
  • numeric neighbors, UUIDs, and identifiers captured in project traffic.

Discovery is bounded by request limits. Candidates should be reviewed before active testing.

Policies

Available policy modes include:

  • horizontal IDOR/BOLA;
  • vertical privilege escalation;
  • missing authentication;
  • function-level authorization/BFLA;
  • admin-only operations;
  • tenant isolation;
  • ownership transfer.

Semantic Response Analysis

Authorization decisions do not rely only on status codes. Analysis also recognizes application-level denial messages in HTTP 200 responses, GraphQL errors and partial data, volatile timestamps and session identifiers, sensitive owner fields, and partial leakage.

Multi-Object Confirmation

A finding can require the same authorization failure across two or more foreign resources before confidence increases. This helps separate an object-specific anomaly from a repeatable access-control defect.

Safe Write Operations

POST, PUT, PATCH, and DELETE campaigns begin in non-transmitting dry-run mode. Execution requires in-application confirmation and enforces strict request limits. Rollback mode captures before and after evidence, sends a cleanup request, and verifies restoration.

GraphQL and WebSocket Authorization

Stored identities can be applied to GraphQL queries and mutations, WebSocket rooms and channels, tenant fields, event replay, and subscriptions. Subscription-abuse testing uses the same evidence and policy model as HTTP authorization.

Findings Workspace

Findings support open, confirmed, rejected, fixed, and inconclusive states; editable severity and confidence; duplicate consolidation; evidence preview; selected JSON, Markdown, and CSV exports; and stable-ID retesting.

Protected and Reproducible Evidence

Evidence can use automatic secret redaction, encrypted project storage, retention limits, and hash-only bodies. Reproducible records can include sanitized requests, replay instructions, identity expiration state, timestamps, WSHawk version, target fingerprints, response hashes, optional screenshots, and a sanitized cURL reproduction.

Reveal and copy actions remain explicit so protected bodies are not exposed accidentally.

Automated Retesting

Retesting classifies a saved finding as:

  • still vulnerable;
  • fixed;
  • authentication expired;
  • endpoint changed;
  • inconclusive.

Authorization Lab

The loopback-only Electron + Go lab contains secure and deliberately vulnerable multi-tenant, UUID, nested-object, GraphQL, WebSocket-room, subscription, mass-assignment, and state-changing authorization controls.

cd electron-desktop
npm run lab
npm run test:authorization-benchmark

The benchmark scores 34 scenarios: 17 secure controls and 17 deliberately vulnerable controls.