Catalogue access permission
Catalogue access permission governs access to a catalogue and its contents. A visible link or a successful sign-in alone is insufficient verification.
Catalogue access permission determines who may access a particular catalogue or its contents. Its scope might be a company account or a location. The products and prices visible must match that assignment.
Enforce permission when retrieving data
In a fictional portal, a purchasing account may retrieve its company's catalogue. Another catalogue is hidden from the menu. Its data is protected only if a direct server request also checks the appropriate permission. A changed catalogue identifier must not return another company's contents without checking.
OWASP calls for checking the requested action on the specific object. Your application therefore needs to assess the user, company assignment and requested access together. Catalogue access can be governed separately from permission to place orders. Check both using suitable test accounts; a successful login confirms only sign-in.
Sources
Related terms
- Customer-specific assortmentA customer-specific assortment defines which items are offered to a customer. Selection, prices and access rights need to fit together in the shop.
- Delivery capabilityDelivery capability describes whether a specific request can be fulfilled. A stock value alone does not fully answer questions of quantity, destination and time.
- Order historyOrder history shows previous orders within an agreed account scope. Old prices, current availability and current processing remain separate information.
- Dealer portalA dealer portal gives affiliated dealers digital access to agreed information and workflows. Its scope and company assignment need to be clear.
- Billing addressThe billing address is a separate address in an order or invoicing process. It must not be accidentally swapped with the delivery address.
- Shipping addressThe shipping address describes a transaction’s delivery destination. Shop and interface must distinguish it from billing details and the current address book.
Articles on this topic
E-Commerce with ASES
Online shops, marketplaces and B2B portals