English
A Security Review for a Small Web Service
Start with one asset and one transaction. An invoice download reveals more about access control than a list of installed security tools.
IN THIS ARTICLE+
A small web service might have only three components: a public application, a database and a job worker. A productive security review starts with what each component is allowed to do. Counting installed security products tells you much less about whether a customer can read another customer's invoice.
Draw the boundary around one transaction
Trace a password reset, invoice download or file upload from the browser to storage. Mark where identity is established, where authorization is checked and where untrusted data becomes input to another system. Include background jobs. A worker that trusts every message in its queue can undo careful validation in the web tier.
Pick an asset worth defending. For invoices, the important property is that only the right account can read the document. For a billing queue, it may be that replaying a message cannot charge the customer twice. These statements are testable; “the application is secure” is not.
Turn a scenario into a check
Consider a signed-in customer requesting an invoice by ID. Create two synthetic accounts in staging. Verify that each can read its own invoice and that neither receives the other's content when the ID is exchanged. Repeat through the export endpoint if it uses a different data path. A hidden link in the interface is not evidence that the server enforces ownership.
Document who can fix a failed check, what evidence will prove the change and which logs would reveal misuse. Avoid logging invoice contents or reset tokens just to make investigation easier.
Leave with a short list
Rank scenarios by exposure, consequences and the strength of existing controls. Assign the first few to actual owners. Revisit the diagram when an integration, new role or public endpoint changes a trust boundary. A short review tied to a real transaction survives architecture changes better than a checklist nobody can connect to the service.
Further reading
OWASP: Threat Modeling Cheat Sheet
Related guide: Object-Level Authorization: Test the Second Account.
No comments yet. Share the first perspective.