Practice · 1 of 3

The Authorization Decision

Declare your authorization model as authz with: authorOnlyEdit (boolean — can non-authors edit or close a ticket?), serverChecks (boolean — is the author check enforced server-side?), and idSource (string: where author identity comes from — "session", "cookie", or "token"; NEVER "request-body").

Difficulty: advanced

Press Submit to check your solution.

Back to lesson: Practice: Capstone Design — Attack Your Own Design