Engineering

Authorization Review Prompt

Hunt the broken-access-control bug — review code for missing per-resource checks, IDOR, and 'logged in' mistaken for 'allowed', the vulnerability class that tops the OWASP list.

Open in Code Review Prompt Generator

Overview

Broken access control is the most common serious web vulnerability, and a generic review skims past it because the code looks fine — it authenticates, it just doesn't authorize. This prompt reviews specifically for authorization: is every object access checked against the caller's permissions, not just their login? Can a user reach another user's record by changing an ID? It finds the per-resource check that isn't there.

How to use this resource

Gather the code and its access rules

Collect the endpoints or handlers that touch protected resources and note who is supposed to be allowed to do what. The review checks authorization, not just login.
Open this resource in Code Review Prompt Generator

Load the prompt into Code Review Prompt Generator and paste in the code. It reviews specifically for missing per-resource checks and IDOR rather than skimming past them.
Review the access-control findings

Read each finding - an object access not checked against the caller, an ID a user could change to reach another record - ranked by risk.
Close the gaps and re-review

Add the missing per-resource checks the review flags, then re-run it to confirm no broken-access path remains.

Why This Works

Broken access control is OWASP #1; a dedicated lens catches what generic review misses
IDOR hides in code that authenticates correctly but never authorizes
Checking API-level (not UI) enforcement catches the most common real bypass

Best for

Apps with multi-user data and per-record access
Code that handles other users' or tenants' data
Pre-release review of authorization-sensitive paths

Not for

Designing the access model — use the RBAC Design Prompt
Broad security review — use the Security Code Review Prompt

Use cases

Reviewing endpoints for missing object-level authorization
Hunting IDOR before a release
Checking that API authorization isn't enforced only in the UI

FAQ

How is the Authorization Review Prompt different from a general security code review?

Its ROLE line scopes the review to broken access control only — not general security, just authorization — so it hunts the six flaws under REVIEW FOR AUTHORIZATION FLAWS (per-resource checks, IDOR, authenticated vs authorized, missing checks, client-side trust, scope leaks) rather than skimming XSS, injection, and secrets. For broad coverage, notFor points to the Security Code Review Prompt.

Why does the authorization review mark some findings CRITICAL and others just MAJOR or MINOR?

The SEVERITY section tells the model to tag every finding [CRITICAL]/[MAJOR]/[MINOR], and it hard-codes one rule: missing object-level authorization and IDOR are CRITICAL. The OUTPUT then groups findings by severity, each citing the exact location and the access it wrongly allows — and stops there, since it says Findings only, do not rewrite the code.

Can I rely on the authorization review prompt instead of a professional security audit?

Treat it as a focused review pass, not an audit substitute. code-review-prompt-generator outputs a prompt you run in your own assistant; the findings are that model's read of the six checks against your pasted routes, controllers, data-access, and auth middleware — recommendations to verify, not a guarantee it caught every broken-access path. You own confirming fixes and shipping.

Customize This Resource

Opens this setup in Code Review Prompt Generator. Generate to get the full review contract — then adjust the focus, scope, language, and style.

Open in Code Review Prompt Generator

Prompt Template

Copy it as-is, or use Open in Code Review Prompt Generator to load it pre-filled and customize it with your own context.

ROLE
You are reviewing code specifically for broken access control — not general security, just authorization.

INPUT
[Paste the code: routes, controllers, data-access, and any auth middleware]

REVIEW FOR AUTHORIZATION FLAWS
1. PER-RESOURCE CHECKS: for every operation on an object, is the caller's permission to THAT object checked — not just that they're logged in?
2. IDOR: can a user reach another user's data by changing an ID, slug, or key in the request?
3. AUTHENTICATED ≠ AUTHORIZED: anywhere 'is logged in' is used where 'is allowed to do this' is required.
4. MISSING CHECKS: endpoints, mutations, or admin operations with no authorization at all.
5. CLIENT-SIDE TRUST: authorization enforced only in the UI, bypassable by calling the API directly.
6. SCOPE LEAKS: list/search endpoints that return records the caller shouldn't see.

SEVERITY
Tag findings [CRITICAL]/[MAJOR]/[MINOR]. Missing object-level authorization and IDOR are CRITICAL.

OUTPUT
Findings grouped by severity, each citing the exact location and the access it wrongly allows. Findings only — do not rewrite the code.

More resources from Code Review Prompt Generator

Resource

Code Review Prompt — the Review Contract

"Review this code" gets shallow comments. The review contract gets findings with severities, a checklist, and a verdict.

Prompt Engineering

Resource

Security Code Review Prompt

Twelve security checks — injection, auth, secrets, SSRF, privilege escalation — reviewed the way an attacker would read the code.

Engineering

Resource

API Review Checklist Prompt

Architecture review for the public surface: abstractions that earn their place, dependency direction, seams, and the patterns the codebase already has.

Engineering

Resources that pair well

Resource

Refactor Prompt — the Behavior Preservation Contract

"Refactor this code" invites silent behavior changes. The refactoring contract preserves business rules, outputs, and side effects — and flags uncertainty instead of deciding it.

Prompt Engineering

Resource

Playwright Test Prompt

getByRole over CSS chains, auto-wait over sleep, web-first assertions — Playwright tests written the way Playwright wants.

Engineering

Resource

Compare Two ChatGPT Prompts

A side-by-side way to decide between two ChatGPT prompt drafts — scored on clarity, specificity, output control, and risk instead of gut feeling.

Prompt Engineering

Related tools

Tool

Code Review Prompt Generator

Generate code review prompts for any scope — snippet, file, diff, or full pull request — with focused review rules.

Coding Workflows

Workflows that use this resource

Workflow

AI Auth & Identity Workflow

Design access control before you build it, not after a breach — choose the authentication approach, model the roles and permissions, review the design for gaps, then document the identity model.

4 steps 45–75 minutes

Guides for this resource

Guide

How to Design an Access-Control Model (RBAC) With AI

Both of them logged in successfully. One of them is looking at a ticket from another company's workspace. Here's how to turn your real actors, resources and actions into a reviewable RBAC model and a permission matrix where every cell says allow, deny, or on what condition.

Software Development with AI

Tip: Save time by exploring related resources and tools that integrate with this resource.