The door you forgot was a door (fail-open checks and logic bugs)

What you are allowed to do, and the bugs that leak data. Two of its rules carry this lesson: deny by default (no rule means no access) and check every request on the server, never trusting the browser’s word. The bugs below are what happens when one of those rules has a gap nobody drew.

Before you start. Authorization & Identity taught the ownership check: logging in proves who you are, not that order 124 is yours. Web Vulnerabilities (the OWASP classics) taught the bugs where an attacker’s text becomes code. Review the fix (secure code review) had you review a dozen fixed handlers, including a form that accepted a field it never meant to. This lesson is about bugs where nobody’s text becomes code and every line looks right: the door is a situation the code never planned for.

The idea in 30 seconds

Apple’s 2014 “goto fail” bug skipped a signature check on a path nobody considered and returned success, so iPhones and Macs accepted forged secure connections.
A check that cannot run must fail closed and answer no; the error itself goes to your own log, and the visitor gets only a reference number.
Mass assignment is closed by copying only an allowlist of fields a user may change.
A business-logic bug is a rule of the business that only the browser enforced; the server must check every rule itself.
A race condition lets two requests both pass a check before either acts; making the check and the action one atomic step closes it.
These bugs hide in what is missing between correct lines, so each needs a test that stages the bad situation on purpose.

Read the story · Skip to the numbers