Vulnerable Web App Structure: 7 Mapping Lessons
Map an authorized web app through roles, requests, inputs, data flows and trust boundaries. Label observations and inferences separately and preserve identity and state context before treating a visible or hidden route as an authorization result.