Museum Wire
Law 0 · Katie's LawEvery system is shaped by the human drive to do less work. This is not a flaw. It is the economic force that produces all software — and all software failure.◆Law I · Boundary CollapseWhen data crosses into a system that interprets structure, without being constrained, it becomes executable.◆◆ 2026 IncidentAxios. 70 Million Downloads a Week. North Korea Inside.◆Law II · Ambient AuthorityWhen a system trusts the presence of a credential instead of verifying the intent behind it, authentication becomes indistinguishable from authorization.◆◈ AXM-001Set Theory — Membership, Boundaries, and Belonging◆Law III · Transitive TrustWhen a system inherits trust from a source it did not verify, the attack surface extends to everything that source touches.◆◆ 2026 IncidentClaude Code — The Accept-Data-Loss Flag◆Law IV · Complexity AccretionSystems do not become complex. They accumulate complexity — one reasonable decision at a time — until no single person can hold the whole in their head.◆Law V · Temporal CouplingCode that assumes sequential execution, stable state, or consistent timing will fail the moment concurrency, scale, or latency proves the assumption wrong.◆◆ 2026 IncidentCopy Fail — 732 Bytes to Root on Every Linux Distribution◆◈ AXM-002Boolean & Propositional Logic — True, False, and the Excluded Middle◆Law VI · Observer InterferenceWhen the system that monitors health becomes a participant in the system it monitors, observation becomes a failure vector.◆◆ 2025Amazon Kiro — The 13-Hour Outage◆◆ 2025Operation Chrysalis: The Notepad++ Supply Chain Hijack◆◆ 2025Replit Agent — The Vibe Code Wipe◆◆ 2025Shai-Hulud — The npm Worm That Ate Its Own Ecosystem◆◆ 2024Air Canada Chatbot — The Policy That Wasn't◆◆ 2024Change Healthcare — One-Third of US Healthcare, One Missing MFA◆◆ 2024CrowdStrike — The Security Update That Broke the World◆◆ 2024Google Gemini Image Generation — The Six-Day Pause◆◆ 2024XZ Utils — The Two-Year Infiltration◆◆ 20233CX — The Supply Chain That Ate Another Supply Chain◆◆ 2023Amazon Prime Video — The Per-Frame State Machine◆◆ 2023Bing Sydney — The Chatbot That Went Rogue◆◆ 2023Samsung ChatGPT Leak — The Employee Who Pasted the Secret◆EFFODE · LEGE · INTELLEGE◆Law 0 · Katie's LawEvery system is shaped by the human drive to do less work. This is not a flaw. It is the economic force that produces all software — and all software failure.◆Law I · Boundary CollapseWhen data crosses into a system that interprets structure, without being constrained, it becomes executable.◆◆ 2026 IncidentAxios. 70 Million Downloads a Week. North Korea Inside.◆Law II · Ambient AuthorityWhen a system trusts the presence of a credential instead of verifying the intent behind it, authentication becomes indistinguishable from authorization.◆◈ AXM-001Set Theory — Membership, Boundaries, and Belonging◆Law III · Transitive TrustWhen a system inherits trust from a source it did not verify, the attack surface extends to everything that source touches.◆◆ 2026 IncidentClaude Code — The Accept-Data-Loss Flag◆Law IV · Complexity AccretionSystems do not become complex. They accumulate complexity — one reasonable decision at a time — until no single person can hold the whole in their head.◆Law V · Temporal CouplingCode that assumes sequential execution, stable state, or consistent timing will fail the moment concurrency, scale, or latency proves the assumption wrong.◆◆ 2026 IncidentCopy Fail — 732 Bytes to Root on Every Linux Distribution◆◈ AXM-002Boolean & Propositional Logic — True, False, and the Excluded Middle◆Law VI · Observer InterferenceWhen the system that monitors health becomes a participant in the system it monitors, observation becomes a failure vector.◆◆ 2025Amazon Kiro — The 13-Hour Outage◆◆ 2025Operation Chrysalis: The Notepad++ Supply Chain Hijack◆◆ 2025Replit Agent — The Vibe Code Wipe◆◆ 2025Shai-Hulud — The npm Worm That Ate Its Own Ecosystem◆◆ 2024Air Canada Chatbot — The Policy That Wasn't◆◆ 2024Change Healthcare — One-Third of US Healthcare, One Missing MFA◆◆ 2024CrowdStrike — The Security Update That Broke the World◆◆ 2024Google Gemini Image Generation — The Six-Day Pause◆◆ 2024XZ Utils — The Two-Year Infiltration◆◆ 20233CX — The Supply Chain That Ate Another Supply Chain◆◆ 2023Amazon Prime Video — The Per-Frame State Machine◆◆ 2023Bing Sydney — The Chatbot That Went Rogue◆◆ 2023Samsung ChatGPT Leak — The Employee Who Pasted the Secret◆EFFODE · LEGE · INTELLEGE◆
Keyboard Navigation
W↑
A←
S↓
D→
or arrow keys · M for map · Q to exit
← Back to exhibits
◎ Auth & AccessDesign FlawEXP-015

The Open Door

When the only thing protecting your data was a number in the URL

2000s · PHP / Java · 5 min read
Pattern Classification
Class
◎ Ambient Authority
Sub-pattern
Missing Authorization
Invariant

When a system trusts the presence of a credential instead of verifying the intent behind it, authentication becomes indistinguishable from authorization.

This Instance

Authentication is checked, but authorization to access a specific resource is assumed from the credential alone

Detection Heuristic

If a system performs a state-changing action because a credential is present — without verifying that the specific request was intentionally initiated by the credential holder — the system trusts authority, not intent.

Same Pattern Class
Why It Persists

Every authentication mechanism that attaches credentials automatically recreates this pattern. Cookies gave way to bearer tokens, tokens to API keys, keys to ambient cloud IAM roles. The carrier changes. The assumption does not.

Pattern Connections
↓ Evolved Into
The Unguarded Memory

Unguarded memory (1960s) is the physical precursor to IDOR (2000s). Both grant access because an identifier is known, not because access is authorized

↔ Cross-Domain Analog
The Phantom Session

Both trust identifiers without verification — IDOR trusts the resource ID, phantom sessions trust the session ID

← Mitigated By
The Committed Secret

Exposed credentials enable unauthorized access — a committed API key bypasses all access control

Year

2003–present

Context

Web applications stored data by ID. Every customer had an ID. Every order had an ID. Every document had an ID. The URL showed the ID: /account/1042, /invoice/8837, /document/download?id=553. The application verified that the user was logged in (authentication). It never verified that the logged-in user was authorized to access that specific resource (authorization). Change the number. See someone else's data.

Who Built This

Web developers who confused authentication with authorization. "The user is logged in" meant "the user can access anything." The frameworks provided authentication middleware. They didn't provide per-resource authorization — that was the developer's responsibility, and the developer often forgot.

Threat Model at Time

Authentication was the security boundary. If you had a valid session, you were trusted. The URL was considered an implementation detail, not an attack surface. Nobody expected users to modify the URL manually — after all, the UI only showed links to their own resources.

Why It Made Sense

Sequential integer IDs were database primary keys. Using them in URLs was natural. The application displayed the user's orders — why would it display anyone else's? The developer tested with one user. One user can't access another user's data because the UI doesn't show links to it. The bug only appears when someone types a different number.

Archaeologist's Note

This pattern has been found in applications built by talented developers at respected organizations across every decade of software history. Its presence in a codebase is not a reflection of the developer who wrote it — it is a reflection of what that developer was taught, what tools they had, and the path that was easiest given what they were taught. The goal is not to find fault. The goal is to find the pattern — before it finds you.

Katie's Law: The developers were not wrong. The shortcut was not wrong. The context changed and the shortcut didn't.

▥ The Web Gallery▸The Authentication Wing4 / 6
←Previous ExhibitMuseum MapNext Exhibit→