Lion Cipher Lab
Implement role-based access control (RBAC) in a web app (hands-on)
- Identity & Access Management
- Intermediate
- ~50 min
- Free · no account required
Why it matters
Almost every real application has more than one kind of user -- an ordinary member and an administrator -- and the job of keeping the ordinary member out of the administrator's screens is called access control. When it is done wrong, a logged-in user can simply visit an admin URL and get in; OWASP ranks this 'broken access control' as the number-one web application security risk, because it is both extremely common and directly hands attackers data and powers that were never theirs. The fix is role-based access control (RBAC): you attach a role to each user and make every sensitive action…
What you'll learn
- telling authentication (who you are) apart from authorization (what you are allowed to do)
- building a tiny Flask web app on your own machine with example users, roles, and protected routes
- explaining what a route, a session, and a decorator are, in plain words
- seeing broken access control for real: a normal user reaching an admin-only page
- writing a role-check decorator that enforces a role before a view function runs
- returning 403 Forbidden for an authenticated user who lacks the required role
- testing BOTH roles to prove the fix -- the user is blocked, the admin still gets in
- applying least privilege and deny-by-default so access is granted on purpose, never by accident
Steps in this lab
- Two words that get confused: authentication vs authorization
- Set up: confirm Python works and install Flask
- Build the app (with the access-control bug on purpose)
- Run it and confirm the intended behavior (log in as admin)
- See the flaw: a normal user walks into the admin page
- Fix it: add a role-check decorator and require the admin role
- Re-test BOTH roles: user blocked, admin still allowed
- The habits that make it stick: least privilege and deny-by-default
- What you did -- and the reflex to keep