Back to projects

Selected project

LMS paywall API
access-control
case study.

Authorized testing found the browser paywall worked, but the backend lesson API still returned paid lesson content to logged-out direct requests.

Role
AppSec tester and report author
Stack
Browser testing, HTTP API, OWASP
Contribution
Testing, evidence, remediation
Outcome
High access-control finding
Redacted evidence exhibit comparing a frontend paywall with a direct backend API request that returned paid content metadata
01

Validated the expected paywall

The assessment started from the normal unpaid-student journey. The lesson page correctly blocked paid content and prompted enrollment in the browser.

02

Checked backend authorization

Public course metadata exposed lesson identifiers. A logged-out request to the lesson API returned a successful response with paid-content fields still present.

03

Confirmed it was systemic

The same behavior repeated against a second paid lesson, while adjacent payment, progress, instructor, and assessment APIs rejected unauthorized access.

04

Produced a remediation path

The report mapped the issue to OWASP broken access control, recommended object-level checks, and retained only sanitized metadata rather than paid lesson bodies.

Redacted AppSec evidence

Proof focused on authorization behavior, not sensitive content.

Domains, course names, lesson titles, user identifiers, cookies, and paid lesson bodies are redacted. The public artifacts show the control boundary, observed response shape, test matrix, root cause, and safer response model.

Redacted exhibit showing frontend paywall displayed while the direct lesson API response included content metadata
Frontend control versus backend API response: the UI blocked the paid lesson, but the direct API path still returned content metadata. Open full-size
Redacted authorization matrix showing expected and actual results for paid lesson, enrollment, progress, instructor, and assessment API checks
Authorization matrix covering positive and negative controls, including logged-out API access, paid enrollment, progress, instructor, and assessment checks. Open full-size
Redacted root cause flow contrasting the vulnerable lesson API path with a corrected object-level authorization path
Root cause and corrected flow: protected lesson records should pass through object-level authorization before paid content is returned. Open full-size

Redacted report

The full DOCX writeup is attached as a portfolio artifact.

The report includes the executive summary, finding metadata, OWASP and CWE mappings, sanitized proof, impact analysis, root-cause explanation, remediation guidance, and retest checklist. The evidence handling notes explain how sensitive content was kept out of the public artifact.

Download redacted DOCX report

Assessment workflow

From normal user journey to backend authorization proof.

  1. Observe the UIConfirm unpaid users see the expected paywall in the normal lesson page.
  2. Trace identifiersUse public course metadata only; avoid brute force, destructive writes, or real-user data extraction.
  3. Test the objectCall the lesson retrieval path from a logged-out session and inspect whether protected content is returned.
  4. Check boundariesCompare nearby APIs to separate the vulnerable endpoint from controls that already reject unauthorized actions.
  5. Define the fixRequire authentication and enrollment, instructor ownership, or admin access before returning paid lesson content.