Permission models fail at the second account
A portal demonstrated with one test customer always looks right. The problems arrive with the second, and with the customer who is also a supplier, the dealer with sub dealers, the group of companies sharing a credit account, and the person who works for two of your customers at once. If the model assumes one user belongs to one account, each of those becomes an exception, and exceptions in a permission model are how data ends up in front of the wrong person.
We separate the user from the account relationship deliberately. A person authenticates as themselves and holds one or more grants against accounts, each with a role. Hierarchies are modelled where they exist, so a parent can be given visibility of children without every child seeing the parent. Roles are defined by what somebody is allowed to do rather than by job title, since titles vary between customers and permissions should not.
Enforcement then happens once, on the server, at the data access layer. Filtering a list in the interface while the underlying endpoint will return any record to anyone who changes an identifier in the address bar is the flaw OWASP describes as broken object level authorisation, and it remains one of the most common serious faults in portals. We test it deliberately, by taking a valid session for one account and attempting to read another account's records, and we keep that test in the regression suite.
- Users separated from account grants, so one person can hold access to several accounts
- Account hierarchies modelled where parents, subsidiaries and sub dealers genuinely exist
- Roles defined by permitted actions rather than by job titles that vary between customers
- Authorisation enforced server side on every request, not by filtering in the interface
- A standing test that attempts cross account access and is expected to fail