HARBOR DESK / 03 / PRACTICE GUIDE

API authorization and business logic testing

Isolate object, action and tenant boundaries. Test forged roles, foreign records and stale updates in the Harbor Desk API.

Download guide and workpapers

Original AI-assisted SecNet educational content; examples are fictional. Not a source organization publication or endorsement. Sources checked: 2026-10-21.

CODE REVIEW DESK

See the decision through the test.

Code here is a local policy model with no target connection. Passing model cases are not security approval or device tests.

A foreign record / Weak code

Inspect an incomplete decision based on record existence or another positive signal. Consider denial cases alongside permitted use.

s=>s.authenticated

Authentication does not grant access to every object. The model denies an actor outside north/ada access to t-1. The actual API returns 404 for other users and tenants; this is the fixture’s chosen non-disclosure policy.

Choices and outputs last only on this open page; they do not update account progress, career status, points or certificates.

01 / EXPLANATION

Object and function authorization

A valid token proves only part of identity. Evaluate object authorization on each record access and function authorization on each privileged action. Ignore an admin role supplied in the body; derive roles server-side. Compare owner and foreign-actor requests, and design foreign/missing responses without leaking record existence.

02 / EXPLANATION

Order, replay and races

Two authorized requests updating the same old version can silently overwrite each other. Compare-and-swap checks expectedVersion against the current version within one atomic write. The single-process fixture has no await between check and write; distributed production needs UPDATE ... WHERE version=? and affected-row checks. External effects such as payments also need idempotency and transaction design.

03 / EXPLANATION

Resource consumption and evidence

Bound body size, pagination, request rate and expensive work; a single rate limit does not solve every abuse path. Consider cost by user, tenant and operation. API Top 10 is an awareness list rather than a complete API verification plan. In the test matrix, enumerate actor × object × action × version and invariants after denial.

04 / EXPLANATION

Worked example: concurrent writes

Ada reads version 1 for two independent operations. If both requests submit version=1, the first accepted update advances it to 2 and the other returns 409. Silently retrying the conflict without reviewing current state can change the user’s intent. The interface should surface the conflict and present current data for a new decision. The HTTP test starts both requests concurrently and expects one 200, one 409 and final version 2. This does not prove distributed database locking: production storage needs the comparison in an atomic query. A correctly versioned but unauthorized request remains a separate denial case.

Build the evidence yourself.

Blank workpapers are not completed tests. Fill them in your authorized environment without secrets or real personal data.

Scope and trust boundariesMarkdown · ENTest plan and expected resultsMarkdown · ENFinding and retest recordMarkdown · ENRelease decision and evidence traceMarkdown · EN
Full guide with code, outputs and reasoning ↓

Primary references

Explanations are authored by SecNet. References support method and platform context; verify current editions and organizational policy for real use.