Fine Grained Authorisation with Relationship Based Access Control
Implementing scalable fine-grained authorization using Relationship-Based Access Control (ReBAC) without hardcoded business logic.
Summary
Limits of Traditional Authorization
Role-Based Access Control (RBAC) and Attribute-Based Access Control (ABAC) struggle to model complex, graph-like permissions such as nested resource hierarchies and social connections without cluttering application code.
Principles of Relationship-Based Access Control
Relationship-Based Access Control (ReBAC) formalizes authorization as a graph of subjects, relations, and objects, enabling dynamic evaluation of complex permissions like transitive ownership and shared folder inheritance.
Deploying Fine-Grained Authorization Services
Live demonstrations show how to define relationship schemas and deploy dedicated authorization engines that decouple access control decisions from core application business logic.
Related talks
OWASP Foundation·32 min
AppSec EU15 - Wojtek Dworakowski - E-Banking Transaction Authorization - Common Vulnerabilities, ...
Wojtek Dworakowski
Security researchers examine technical aspects of AppSec EU15 - Wojtek Dworakowski - E-Banking Transaction Authorization - Common Vulnerabilities, ....
Mobile Village·25 min
Bogdan Tiron
Examines authorization and access control vulnerabilities in GraphQL and REST APIs, using the Feeld dating app data leak as a case study in data exposure.
DCGVR Village·40 min
Abhijeet Singh
Abhijeet Singh examines business logic flaws and authorization bypasses in web applications that defeat traditional security scanners.