B01 Business Logic Trust of Client

What this means

SiteShadow flagged code where the server is trusting client-provided values for security- or access-sensitive decisions (role, permissions, account state, limits, feature flags).

Why it matters

Attackers can manipulate client data to bypass business rules.

• Business logic abuse: set quota=unlimited, approval=true, limit=unlimited.
• Privilege escalation: set role=admin, scope=all, limit=unlimited.
• State tampering: skip required workflow steps by sending "final" states directly.

Safer examples

1) Recompute sensitive values on the server

// Client sends: { action: "export" }
const action = req.body.action;
const policy = serverPolicy[action];      // server source of truth
assertAllowed(req.user, policy);          // server-side authorization

2) Enforce allowed state transitions server-side

allowed = {
  "draft": {"submitted"},
  "submitted": {"approved", "rejected"},
}
if new_state not in allowed[old_state]:
    raise PermissionError("Invalid transition")

3) Use allowlists/DTOs for updatable fields

Only allow safe fields to be set by the client. Everything else is server-controlled (see API01).

How SiteShadow detects it (high level)

• Flags client-controlled fields being used in sensitive decisions (authorization, role, state).
• Looks for "trust boundary" signals like request body values flowing into account-state or permission code paths.

References

• OWASP Top 10: https://owasp.org/Top10/

---

← Back to Vulnerability Library