{% extends 'core/Broken Access Control/broken-access.html' %} {% load static %} Title {% block inside-content %}

Now let's see some examples

There are many ways to go about Broken access, but let's see the most common ones.
You can try them yourselves using this website. First is Forced browsing, where we will manually try to access windows, which we are not supposed to, through URLs.

Open another instance of this website and paste this into the browser search bar: 

http://127.0.0.1:8000/admin

As you can see, it will take us to the admin page. This is the simplest method that allows you to gain access to places you are not meant to be. In this instance, allowing the user to see this page is not the biggest issue since frameworks like Django have built-in admin authentication. However, when we allow a user to see this page we need to be extra careful with our passwords.
We could also try to access specific users such as: 

http://127.0.0.1:8000/admin/auth/user/5/change/

https://website.com/profile?id=1

https://website.com/index.php/view?account=1

The first link is how we change user in django the other two are from different frameworks.
Now let's see what would happen if such routes were not secured: 

http://127.0.0.1:8000/problems/broken_access/user1

Unprotected URLs may lead to the personal information of our users. However, this is just an example. In reality URLs would look something like the example shown above.

{% endblock %}