---
title: "Broken access control and SSRF · vuejs.school"
description: "Check in every handler that the record or action belongs to the person asking, keep admin checks on the server, allow-list CORS origins, and never let a visitor choose where your server sends requests."
canonical_url: "https://vuejs.school/learn/security/broken-access-control"
meta:
  "og:description": "Check in every handler that the record or action belongs to the person asking, keep admin checks on the server, allow-list CORS origins, and never let a visitor choose where your server sends requests."
  "og:image": "https://vuejs.school/_og/d/a_~QnJva2VuIGFjY2VzcyBjb250cm9sIGFuZCBTU1JGIMK3IHZ1ZWpzLnNjaG9vbA%2Cc_OgCard.takumi%2Ctitle_Broken%2Baccess%2Bcontrol%2Band%2BSSRF%2Cdescription_~Q2hlY2sgaW4gZXZlcnkgaGFuZGxlciB0aGF0IHRoZSByZWNvcmQgb3IgYWN0aW9uIGJlbG9uZ3MgdG8gdGhlIHBlcnNvbiBhc2tpbmcsIGtlZXAgYWRtaW4gY2hlY2tzIG9uIHRoZSBzZXJ2ZXIsIGFsbG93LWxpc3QgQ09SUyBvcmlnaW5zLCBhbmQgbmV2ZXIgbGV0IGEgdmlzaXRvciBjaG9vc2Ugd2hlcmUgeW91ciBzZXJ2ZXIgc2VuZHMgcmVxdWVzdHMu%2Ceyebrow_~U2VjdXJpdHkgJiBPV0FTUCDCtyBMZXNzb24gMyBvZiA3%2Ctint_lilac%2Cp_Ii9sZWFybi9zZWN1cml0eS9icm9rZW4tYWNjZXNzLWNvbnRyb2wi%2Cs_MqnjUWfm_842LSnJ.png"
  "og:image:alt": "Broken access control and SSRF · vuejs.school"
  "og:image:height": "600"
  "og:image:type": image/png
  "og:image:width": "1200"
  "og:title": "Broken access control and SSRF · vuejs.school"
  "twitter:image": "https://vuejs.school/_og/d/a_~QnJva2VuIGFjY2VzcyBjb250cm9sIGFuZCBTU1JGIMK3IHZ1ZWpzLnNjaG9vbA%2Cc_OgCard.takumi%2Ctitle_Broken%2Baccess%2Bcontrol%2Band%2BSSRF%2Cdescription_~Q2hlY2sgaW4gZXZlcnkgaGFuZGxlciB0aGF0IHRoZSByZWNvcmQgb3IgYWN0aW9uIGJlbG9uZ3MgdG8gdGhlIHBlcnNvbiBhc2tpbmcsIGtlZXAgYWRtaW4gY2hlY2tzIG9uIHRoZSBzZXJ2ZXIsIGFsbG93LWxpc3QgQ09SUyBvcmlnaW5zLCBhbmQgbmV2ZXIgbGV0IGEgdmlzaXRvciBjaG9vc2Ugd2hlcmUgeW91ciBzZXJ2ZXIgc2VuZHMgcmVxdWVzdHMu%2Ceyebrow_~U2VjdXJpdHkgJiBPV0FTUCDCtyBMZXNzb24gMyBvZiA3%2Ctint_lilac%2Cp_Ii9sZWFybi9zZWN1cml0eS9icm9rZW4tYWNjZXNzLWNvbnRyb2wi%2Cs_MqnjUWfm_842LSnJ.png"
  "twitter:image:alt": "Broken access control and SSRF · vuejs.school"
---

> Index of every page on this site: [llms.txt](https://vuejs.school/llms.txt)

# **Broken access control and SSRF**

Check in every handler that the record or action belongs to the person asking, keep admin checks on the server, allow-list CORS origins, and never let a visitor choose where your server sends requests.

```json
{"@context":"https://schema.org","@graph":[{"@id":"https://vuejs.school/#website","@type":"WebSite","description":"A free AI-instructed school for Vue.js. Short tutorials, runnable code and quizzes that adapt to you.","name":"vuejs.school","url":"https://vuejs.school/","publisher":{"@id":"https://vuejs.school/#identity"}},{"@id":"https://vuejs.school/learn/security/broken-access-control#webpage","@type":"WebPage","description":"Check in every handler that the record or action belongs to the person asking, keep admin checks on the server, allow-list CORS origins, and never let a visitor choose where your server sends requests.","name":"Broken access control and SSRF","url":"https://vuejs.school/learn/security/broken-access-control","breadcrumb":{"@id":"https://vuejs.school/learn/security/broken-access-control#breadcrumb"},"isPartOf":{"@id":"https://vuejs.school/#website"},"potentialAction":[{"@type":"ReadAction","target":["https://vuejs.school/learn/security/broken-access-control"]}],"primaryImageOfPage":{"@id":"https://vuejs.school/#logo"}},{"@id":"https://vuejs.school/#identity","@type":"Organization","description":"A free AI-instructed school for Vue.js. Short tutorials, runnable code and quizzes that adapt to you.","name":"vuejs.school","url":"https://vuejs.school","logo":{"@id":"https://vuejs.school/#logo"}},{"@id":"https://vuejs.school/learn/security/broken-access-control#article","description":"Check in every handler that the record or action belongs to the person asking, keep admin checks on the server, allow-list CORS origins, and never let a visitor choose where your server sends requests.","headline":"Broken access control and SSRF","inLanguage":"en","isAccessibleForFree":true,"thumbnailUrl":"https://vuejs.school/_og/d/a_~QnJva2VuIGFjY2VzcyBjb250cm9sIGFuZCBTU1JGIMK3IHZ1ZWpzLnNjaG9vbA%2Cc_OgCard.takumi%2Ctitle_Broken%2Baccess%2Bcontrol%2Band%2BSSRF%2Cdescription_~Q2hlY2sgaW4gZXZlcnkgaGFuZGxlciB0aGF0IHRoZSByZWNvcmQgb3IgYWN0aW9uIGJlbG9uZ3MgdG8gdGhlIHBlcnNvbiBhc2tpbmcsIGtlZXAgYWRtaW4gY2hlY2tzIG9uIHRoZSBzZXJ2ZXIsIGFsbG93LWxpc3QgQ09SUyBvcmlnaW5zLCBhbmQgbmV2ZXIgbGV0IGEgdmlzaXRvciBjaG9vc2Ugd2hlcmUgeW91ciBzZXJ2ZXIgc2VuZHMgcmVxdWVzdHMu%2Ceyebrow_~U2VjdXJpdHkgJiBPV0FTUCDCtyBMZXNzb24gMyBvZiA3%2Ctint_lilac%2Cp_Ii9sZWFybi9zZWN1cml0eS9icm9rZW4tYWNjZXNzLWNvbnRyb2wi%2Cs_MqnjUWfm_842LSnJ.png","@type":["Article","TechArticle"],"articleSection":["Security"],"author":{"@id":"https://vuejs.school/#identity"},"image":{"@id":"https://vuejs.school/#/schema/image/1"},"isPartOf":{"@id":"https://vuejs.school/learn/security/broken-access-control#webpage"},"keywords":["object-level authorization","function-level authorization","deny by default","CORS with credentials","SSRF"],"mainEntityOfPage":{"@id":"https://vuejs.school/learn/security/broken-access-control#webpage"},"publisher":{"@id":"https://vuejs.school/#identity"}},{"@id":"https://vuejs.school/learn/security/broken-access-control#breadcrumb","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","name":"Skill tree","item":"https://vuejs.school/track","position":1},{"@type":"ListItem","name":"Security & OWASP","item":"https://vuejs.school/track/security","position":2},{"@type":"ListItem","name":"Broken access control and SSRF","position":3}]},{"@id":"https://vuejs.school/#logo","@type":"ImageObject","caption":"vuejs.school","contentUrl":"https://vuejs.school/apple-touch-icon.png","inLanguage":"en","url":"https://vuejs.school/apple-touch-icon.png"},{"@id":"https://vuejs.school/#/schema/image/1","@type":"ImageObject","contentUrl":"https://vuejs.school/_og/d/a_~QnJva2VuIGFjY2VzcyBjb250cm9sIGFuZCBTU1JGIMK3IHZ1ZWpzLnNjaG9vbA%2Cc_OgCard.takumi%2Ctitle_Broken%2Baccess%2Bcontrol%2Band%2BSSRF%2Cdescription_~Q2hlY2sgaW4gZXZlcnkgaGFuZGxlciB0aGF0IHRoZSByZWNvcmQgb3IgYWN0aW9uIGJlbG9uZ3MgdG8gdGhlIHBlcnNvbiBhc2tpbmcsIGtlZXAgYWRtaW4gY2hlY2tzIG9uIHRoZSBzZXJ2ZXIsIGFsbG93LWxpc3QgQ09SUyBvcmlnaW5zLCBhbmQgbmV2ZXIgbGV0IGEgdmlzaXRvciBjaG9vc2Ugd2hlcmUgeW91ciBzZXJ2ZXIgc2VuZHMgcmVxdWVzdHMu%2Ceyebrow_~U2VjdXJpdHkgJiBPV0FTUCDCtyBMZXNzb24gMyBvZiA3%2Ctint_lilac%2Cp_Ii9sZWFybi9zZWN1cml0eS9icm9rZW4tYWNjZXNzLWNvbnRyb2wi%2Cs_MqnjUWfm_842LSnJ.png","inLanguage":"en","url":"https://vuejs.school/_og/d/a_~QnJva2VuIGFjY2VzcyBjb250cm9sIGFuZCBTU1JGIMK3IHZ1ZWpzLnNjaG9vbA%2Cc_OgCard.takumi%2Ctitle_Broken%2Baccess%2Bcontrol%2Band%2BSSRF%2Cdescription_~Q2hlY2sgaW4gZXZlcnkgaGFuZGxlciB0aGF0IHRoZSByZWNvcmQgb3IgYWN0aW9uIGJlbG9uZ3MgdG8gdGhlIHBlcnNvbiBhc2tpbmcsIGtlZXAgYWRtaW4gY2hlY2tzIG9uIHRoZSBzZXJ2ZXIsIGFsbG93LWxpc3QgQ09SUyBvcmlnaW5zLCBhbmQgbmV2ZXIgbGV0IGEgdmlzaXRvciBjaG9vc2Ugd2hlcmUgeW91ciBzZXJ2ZXIgc2VuZHMgcmVxdWVzdHMu%2Ceyebrow_~U2VjdXJpdHkgJiBPV0FTUCDCtyBMZXNzb24gMyBvZiA3%2Ctint_lilac%2Cp_Ii9sZWFybi9zZWN1cml0eS9icm9rZW4tYWNjZXNzLWNvbnRyb2wi%2Cs_MqnjUWfm_842LSnJ.png"}]}
```