
Authorize a Server Action at the Operation, Not Just at the Button
A hidden admin control is not an authorization policy. Define the identity, capability and record scope required for the operation. Check those…
Read the guideA considered approach to websites, stores and content platforms.
Explore ServicesPractical craft for people building for the web.
Explore DevelopmentLearn something. Find a tool. Meet your next collaborator.
Practical ideas for your next build.
Find useful software and free utilities.
Meet makers and find expert help.
Finding your next read
Tag
Everything we have published about Application security: practical ways to evaluate, choose, and work with it.

A hidden admin control is not an authorization policy. Define the identity, capability and record scope required for the operation. Check those…
Read the guideTurn browsing into a useful plan. Follow a focused reading path, or start with the guide closest to the problem in front of you.
Explore Application security through published how-to articles.
1 guide · 2 min in this pathA hidden admin control is not an authorization policy. Define the identity, capability and record scope required for the operation. Check those…
Read the guide
Simple resources to make your next website decision easier. Editable files, ready to adapt to your own workflow.
Subscribe to FinderPress for practical web guides and ideas. Confirm by email, and unsubscribe whenever you like.
Make the most of the Application security collection.
Our editorial approach ↗Choose a reading path that matches your next task. For a wider overview, browse the Application security archive above and use its topic filters.
Use “Search in this archive” above. You can also change the filters, sort order or grid/list view without leaving this topic.
Yes. The checklists and worksheets linked below are editable files with no account required. Adapt them to your own project.
Check the article date, its scope and any linked sources. Test a change with representative content before applying it to a live project.
Yes. Use the contact page to suggest a topic, or read the contributor guidelines if you would like to pitch an original guide.