SGSPECTER.GHOSTCOMMUNITY EDITION
← LABS
// GUIDED TRAINING · API

Checkout Boundary

Object-level authorization

Medium300 PTSOFFLINE SIMULATION
// 01 · LEARN

OBJECT-LEVEL AUTHORIZATION

Order endpoints must check that the authenticated user is allowed to view each order, not just that the token is valid.

LEARNING GOAL

Identify the failure from the supplied synthetic evidence and explain a defensive fix.

// 02 · INVESTIGATE

EVIDENCE

GET /api/orders/401
Authorization: Bearer user-12
200 {"order":401,"owner":12,"total":25}
GET /api/orders/402
Authorization: Bearer user-12
200 {"order":402,"owner":99,"total":90,"audit":"orders_need_ownership"}
HINT

Compare owner 99 with user 12.

// 03 · PRACTICE

KNOWLEDGE CHECK

Which order belongs to another customer?

// 04 · CAPTURE FLAG

Submit the review marker in SG{marker} format.

Progress stays in this browser.