Tente resolver a tarefa antes de consultar os critérios. Compare o resultado e explique o que mudou no seu raciocínio.
Tarefa e critérios de verificação
Task, 15 minutes: two test users own different orders, and each order is private to its owner. User A requests GET /orders/{B-order-id} with a valid session. Write the authorization rule and a local negative test. Then review a list endpoint that accepts a sort direction and a cookie-authenticated mutation that needs CSRF protection.
Check your work:
- User A cannot read B's order even though A is authenticated. The data lookup enforces ownership or the applicable access policy.
- A missing/invalid credential and an authenticated but forbidden operation have deliberate response behavior. Avoid leaking private order details in either case.
- Filter values use bound parameters. Sort direction maps to a fixed allowlist such as ASC or DESC rather than arbitrary SQL text.
- Cookie-authenticated mutations have the required CSRF checks. HttpOnly prevents token reading but does not authorize requests or make XSS harmless.
Follow-up: repeat the ownership check through a cache hit and through a batch lookup. Security must hold on every path, not only the first database query.
No app, a tarefa fica visível e você pode revelar os critérios depois da tentativa. Use as notas para registrar sua solução.
Praticar este exercício no app