CTF lab: understand object ownership checks
A small, local-only exercise showing why authentication and authorisation are different decisions.
The scenario
This is an original toy exercise, not a write-up of a client system or a completed third-party challenge. Two users share a document application. Each document has an owner. The task is to describe the missing check and the expected result after it is added.
The deliberately incomplete decision
Imagine a function that returns a document whenever the caller is signed in. It has established identity but has not compared that identity with the document owner. The error is in the policy decision; guessing identifiers is not the essential concept.
Build the test matrix
Use two synthetic users, alice and bob, and two synthetic documents. Alice reading Alice’s document should succeed. Alice reading Bob’s document should fail unless an explicit sharing rule allows it. Repeat the same cases for Bob. Also include an unauthenticated request.
The correction
Express the intended rule in one place: require an authenticated user, then require ownership or an explicit permission for the requested action. Apply it before returning the document. Keep the default decision closed when a required property is missing.
What to take into real reviews
Ask where the server makes the ownership decision and whether every access path uses it. Review read, update and delete separately. Save the synthetic test cases as regression checks so later changes do not quietly remove the boundary.