MSAMM
Back to course

Oracle Visual Builder: Applications That Outlive Their First Release · Module 11 · Security: who sees what

Lab briefing · Attack your own application

Lesson 118 of 176 · 3 min

With the network tab AND NOTHING ELSE, find EVERYTHING YOUR APPLICATION SENT THAT THE USER SHOULD NOT HAVE. Then CLOSE EACH ONE AT THE SOURCE. The constraint is the lesson: no tools beyond the ones every user already has, because that is exactly the position anybody looking at your application is in. WORK PAGE BY PAGE AND READ EVERY RESPONSE, NOT THE SCREEN. For each one, ask two questions. Are there ROWS here this user should not see? Filtered out in the page, belonging to another department, another owner, another region. Are there FIELDS here they should not see? Hidden columns, values behind a role check, anything the page received and did not draw. DO THE WRITE REQUESTS TOO, WHICH PEOPLE FORGET. Open a form, submit it, and read what was SENT. A hidden field carrying a value the user never saw is data being written on their behalf that…

The full lesson is part of the course

The video, the complete written lesson and the module quiz are included in Oracle Visual Builder: Applications That Outlive Their First Release, with a certificate on completion and a fourteen-day refund window.

See the course and enrol9 free lessons

Get the free lessons by email

We will email you a link to every free lesson in this course. No account needed, and one message only.

In this module: Module 11 · Security: who sees what

  1. 1Where the trust boundary is
  2. 2Filtering in the UI is not securityFree preview
  3. 3Hiding a field sends it anyway
  4. 4Filter at the source
  5. 5Identity propagation, properly
  6. 6Roles inside your application
  7. 7Securing business object endpoints
  8. 8Secrets do not go in an application
  9. 9What ends up in a log or a URL
  10. 10What breaks: four security findings
  11. 11Lab briefing · Attack your own application