Glossary term
What is RBAC (Role-Based Access Control)?
RBAC stands for Role-Based Access Control.
In Backend in Depth
Permissions go to roles (like admin or editor). Users are given roles.
Learn it properly · Backend in DepthLesson 6: Authentication and Authorization on the ServerPassword hashing, session stores, checking JWTs properly, role-based vs attribute-based access control, and checking ownership on every resource.In Security for Developers
Deciding access by the user's role, such as admin or user. Good for broad powers, but not enough to protect each user's own records.
Learn it properly · Security for DevelopersLesson 4: Access Control: IDOR, Roles and Mass AssignmentThe number one web risk: checking who you are but not what you may do. IDOR with a real example, deny by default, roles and ownership checks, and mass assignment.