Security Testing
OpenFGA (Fine-Grained Authorization) is an open-source authorization system developed by Okta, based on Google Zanzibar. It lets you define relationship-based access control (ReBAC) models — "user X has role Y on resource Z" — and check them at runtime. It's the engine behind Auth0'
Testing
Row-Level Security (RLS) is PostgreSQL's mechanism for enforcing data access policies at the database layer. For multi-tenant SaaS applications, RLS is a powerful defense-in-depth tool — even if application-layer authorization has a bug, RLS prevents cross-tenant data leakage at the database level. But
Testing
Role-Based Access Control (RBAC) is the authorization layer that ensures users can only access what they're permitted to. Manual testing of RBAC is insufficient — authorization bugs are subtle, easy to miss, and have severe consequences. Automated RBAC tests verify every permission boundary systematically. This guide covers implementing
Testing
Privilege escalation occurs when a user gains access or capabilities beyond what they were granted. Vertical escalation is gaining a higher role (user → admin); horizontal escalation is accessing another user's resources at the same privilege level. Both are critical security vulnerabilities that automated testing must catch. This guide
Testing
OAuth 2.0 and OpenID Connect (OIDC) are the foundation of modern authorization. Testing them is challenging because they involve multiple parties (client, authorization server, resource server), time-sensitive tokens, and complex flows. Bugs in OAuth implementations lead to security vulnerabilities that are hard to detect manually. This guide covers