Authorization
Also called: AuthZ
Checking what a logged-in user is allowed to see or do.
Definition
Authorization answers "what can you do?". After logging in, users should only reach their own data and the features their role allows. Testers try to open other users' data or admin pages by changing URLs or IDs.
In practice
Changing /orders/1042 to /orders/1043 in the browser must not show another customer's order.
Learn it in context
Lessons that use this term.