{% extends 'core/Broken Access Control/broken-access.html' %}
{% load static %}

<!DOCTYPE html>
<html lang="en">
<head>
    <meta charset="UTF-8">
    <title>Title</title>
</head>
{% block inside-content %}
    <div class="bg-white nav-item flex-grow bg-opacity-20 backdrop-filter backdrop-blur-md w-4/5 problems-container">
        <h1 class="text-center text-white font-bold">What is Broken Access Control?</h1>
        <p class="text-white pt-5">
            It is a way to access restricted areas with no or insufficient permissions. Such as letting unauthorized
            users access URLs they are not meant to or accessing URLs that hold data with no authorization. Leaving this
            vulnerability unchecked means free access to reading, editing, and deleting our web application data. At
            times attackers can pretend to be various roles and access different places.<br>
            Some common issues include:
        </p>
        <ul class="list-disc text-white pl-5">
            <li>Lack of, insufficient or no authentication</li>
            <li>Incorrectly set up or lacking permission</li>
            <li>Weak passwords</li>
        </ul>
        <p class="text-white pt-5">
            A typical case of broken access is allowing users to view or edit data without authenticating first,
            allowing attackers easy access. Another vulnerability is users being able to use the functionality they
            shouldn't have access to, like admin functions.
            <br>
            <br>
            This type of vulnerability is hazardous and essential to prevent. Not doing so might lead to data theft,
            modification or deletion of data, or possession of the whole website.
            <br>
            <br>
            The most common way to stop Broken Access Control attacks is by  <span class="font-bold">Access Validation </span>.
            Users will need to be authenticated first, so attempts made by unauthorized ones will be shut down.
        </p>
    </div>
{% endblock %}
</html>