detect-web-broken-access-control

Detect OWASP Top 10 A01:2021 (Broken Access Control) signals in HTTP access logs. Reads OCSF 1.8 HTTP Activity (class 4002) records and fires when one of two deterministic patterns appears: (1) the resource path embeds a user / account / object id that does not match the actor's authenticated subject claim (IDOR — horizontal privilege escalation), or (2) a 4XX response from one principal is followed inside a short window by a 2XX response on the exact same URL after an Authorization header swap (the "auth-swap flip" — typical privilege bypass via stolen / forged token). Emits OCSF Detection Finding 2004 tagged OWASP A01 + MITRE ATT&CK T1212. Use when an ingestion pipeline normalizes web-server / WAF / API-gateway logs into OCSF 4002 and you want a deterministic, no-LLM authz-violation detector. Do NOT use as a WAF, as a posture check on IAM policies (different surface — see CSPM benchmarks), for service-mesh L7 authorisation (Envoy / Istio emit a different log shape), or as a substitute for application-layer authorization tests in CI.