Practice · 1 of 3

The Authorization Decision

CHALLENGE

Difficulty: advanced+25 XP

Declare your authorization model as authz with: authorOnlyEdit (boolean — can non-authors edit or close a ticket?), serverChecks (boolean — is the author check enforced server-side?), and idSource (string: where author identity comes from — "session", "cookie", or "token"; NEVER "request-body").

Press Submit to check your solution.

Back to lesson: Practice: Capstone Design — Attack Your Own Design