Test API authorization with two users
Keep the caller signed in as A and change only the object ID from A’s document to B’s. B’s private marker in A’s response is evidence of an authorization failure. A denial is useful only if both legitimate owners can still read their own data.
What to prepare
Use two separate sessions on an authorized test deployment. For the local exercise, download access-fixture.py and run python3 access-fixture.py. Its X-Fixture-User header is a teaching device, not an authentication scheme for a real API.
Verification procedure
Establish the owner controls
Read doc-a as A and doc-b as B. Record the status and the distinct marker in each body. A gateway rejecting every request can look like a successful security fix if you omit these controls.
Replay the same cross-owner read
Read doc-b as A. The vulnerable fixture returns synthetic-private-B. In fixed mode the same request returns 403 without the marker. Read doc-b as B again to prove the intended path still works.
Hold the identity and object constant across the two fixture versions
curl -si -H "X-Fixture-User: a" "http://127.0.0.1:8769/documents/doc-b?mode=vulnerable"
curl -si -H "X-Fixture-User: a" "http://127.0.0.1:8769/documents/doc-b?mode=fixed"Decision and limitations
Record the tested revision, identity, object, expected decision and sanitized observation in the fix ticket. Close it when the same cross-owner request is blocked and both owners retain access.
What remains unverified
One GET does not cover writes, exports or other tenants. An intentionally shared document is not a valid negative control.