Teaching plan: Whose record is this?
Preparation
Install Node 22 or newer on lab machines before class. Students need a desktop browser and plain-text editor; no package manager experience or server background is assumed. Test the exported student kit on a clean machine/folder. Do not assume students know what a terminal, working directory or server process is.
The runnable student app is in ../student relative to this directory. Prefer opening that folder in the editor and using its integrated terminal. From that folder use node server.mjs; from ../solution the same command starts the reference solution. Stop one before starting the other, because both use port 3000.
Read the walkthrough, rubric and safety. Export students' files from the repository root with node tooling/package-student-kit.mjs 05-broken-access-control node ./dist/access-control. Distribute the whole kit, not just the HTML file. Check first that this output folder does not already exist.
Objectives
Students distinguish identity from permission, demonstrate an ownership failure using fictional records, implement one server-side comparison, and verify positive and negative cases. They need not understand the HTTP server implementation or build authentication. The guided route earns full marks.
Suggested 75–90 minute session
| Minutes | Activity | Check understanding |
|---|---|---|
| 0–10 | Start supplied app; explain terminal and localhost. | Everyone sees the portal. |
| 10–20 | Explain browser/server, requests, IDs, identity and permission. | Can an ID be a permission? |
| 20–30 | Request 101 and 102 in the vulnerable starter. | Identity remains Alex in both cases. |
| 30–40 | Teach objects, property access, return and strict equality. | Compare two sample strings before code. |
| 40–50 | Fill the single blank, save and restart. | Students edit only authorize.mjs. |
| 50–65 | Manual requests and supplied checks. | Own record still works; other record is denied. |
| 65–75 | Explain and submit; use remaining time for support. | Permission is enforced on the server. |
Install/setup problems may need separate preparation time.
Support and extension
Pair students for setup if helpful, but ask each to explain the ownership comparison. Provide the full scaffold from the worksheet; do not turn the lesson into a syntax guessing test. Advanced role-based policy is discussion-only and not needed for credit.
If Node is unavailable, demonstrate the app from the instructor machine and have students describe the repair; label this as observation rather than a completed hands-on lab. Do not imply they ran checks they did not run.
This covers a worked example within OWASP A01:2025, not the entire category. It teaches application authorization rather than dependency scanning. Never ask students to test real campus portals.