RBAC Security Testing — 20-Point Checklist for QA (2026)

Last updated 2026-07-20 · 11 min read · By Avinash K

Broken Access Control has been the #1 OWASP category since 2021. Most QA teams still cover it with "log in as user, log in as admin, screenshot." This checklist gives you 20 concrete tests, grouped by attack class, with copy-paste requests you can drop into Postman or Playwright.

Key takeaways

• The 4 RBAC attack classes.
• 20 concrete test cases with requests.
• IDOR patterns most QA teams miss.
• JWT tampering — the 3-minute test.

• Vertical escalation — user acts as admin.
• Horizontal escalation — user A acts as user B.
• IDOR — swap object IDs in the URL.
• Token tampering — JWT alg=none, role field changed.

1. Every protected route returns 401 without a session.
2. Every admin route returns 403 for a normal user session.
3. Direct-hitting a hidden UI path (not linked) still enforces auth.
4. PATCH/DELETE endpoints check ownership, not just auth.
5. Swapping userId=1 to userId=2 in URL returns 403.
6. Same swap in request body returns 403.
7. Same swap in JWT claim returns 403 (with re-signing attempt).
8. JWT with alg=none is rejected.
9. Expired JWT is rejected on every route (not just login).
10. Refresh tokens rotate — reuse of old refresh = revoke session.
11. Rate limit on login = brute force blocked at 10 attempts.
12. Password reset link is single-use and expires <15 min.
13. Session cookie is HttpOnly, Secure, SameSite=Lax or stricter.
14. Logout invalidates server-side session, not just client cookie.
15. Concurrent session cap enforced (or documented as not enforced).
16. SSO fallback disabled when SSO is required.
17. API keys scoped — cannot escalate via key.
18. Team invite links expire & are single-use.
19. Downloaded files check ownership (S3 signed URL, not public bucket).
20. Admin actions logged with actor + subject + timestamp.

# Log in as user A, capture their token
curl -H "Authorization: Bearer $TOKEN_A" \
  https://app.test/api/orders/1001   # OK

# Same token, guess user B's order ID
curl -H "Authorization: Bearer $TOKEN_A" \
  https://app.test/api/orders/1002   # MUST be 403 or 404

Automate this with our cURL → Playwright converter then loop across 1000 IDs.

Paste any JWT into our JWT debugger, change role: "user" to role: "admin", sign with alg=none, resend. If the server accepts it, ship a P0. Reference: OWASP A01:2021. Related: REST Assured tutorial.