Study. uk . com
  1. Home
  2. All questions
  3. Question 348

CompTIA Security+ study material · question 348 of 611

An application hides the delete button from non-administrators but the delete endpoint performs no check. What is wrong?

  1. Access control decisions must be enforced on the server
  2. The endpoint should require a CSRF token
  3. The button should be disabled rather than hidden
  4. The endpoint should be rate limited
Show the answer

Answer: A. Access control decisions must be enforced on the server

Anything enforced only in the browser is bypassed by calling the endpoint directly.

Source: OWASP Top 10 (OWASP) — OWASP Top Ten › Broken Access Control

Challenge yourself on this topic → Study as cards