07.03 · Lecture
Access Control at the Data Layer
Explain how a session establishes who someone is on later requests, and how session hijacking takes that identity over.
Session identity is just a trusted token mapped to a user, so whoever presents that token can act as that user. Data-layer access control keeps every read and write constrained to the authenticated subject, limiting damage from stolen sessions, missing route checks, object ID guessing, and tenant filter mistakes.
What this lesson answers
- how does a session identify later requests
- what happens when a session cookie is stolen
- why enforce access control in database queries
Notes
Access Control at the Data Layer — Access control at the data layer exists to ensure each database read or write is authorized for the user identity carried by the session; without it, a stolen session or missing tenant filter can expose or mutate another user’s records.
Key Concepts: - A login typically creates a server-side session row such as `sessions(id="abc123", user_id=42, expires_at=...)`, and later requests authenticate by sending `Cookie: session_id=abc123`.
References
Common questions
- How does a web session prove who the user is after login?
- After login, the server creates or signs session state that links a random token to a user identity. The browser sends that token on later requests, usually as a cookie. The application resolves the token back to the user and treats the request as coming from that authenticated subject.
- Why is a stolen session token enough to impersonate someone?
- A bearer session token grants access to whoever presents it. If an attacker gets the cookie or token, the server cannot distinguish them from the real browser unless extra controls catch it. The attacker keeps that identity until the session is expired, revoked, rotated, or otherwise rejected.
- Why put access checks in the data layer?
- Route and UI checks are easy to miss or bypass through another code path. Data-layer checks make the query itself depend on the authenticated user or tenant, so fetching by object ID alone is not enough. Database policies can also reject unsafe reads or writes when application code forgets a predicate.
Short definition: what is Access Control at the Data Layer?