Auth Contexts
The three perspectives from which every oracle must be evaluated. The same endpoint can have an oracle in one context and none in another.
Every oracle must be evaluated across three authentication contexts, because the oracle that exists — and its severity — depends entirely on who is observing it:
- Unauthenticated — no credentials. The server has no identity for the caller. An oracle here means anyone on the internet can enumerate resources.
- Authenticated, no access — valid credentials, but the resource is off-limits. The server knows who the caller is and rejects the request. An oracle here means authenticated users can discover resources they shouldn't know about.
- Authenticated, has access — valid credentials, resource is readable. Confirms existence and may return the full resource representation (IDOR).
The same endpoint can have an oracle in one context and no oracle in another. A server might normalize 403/404 for unauthenticated callers but leak the differential to authenticated ones, or vice versa.
parlov evaluates one auth context per invocation. The operator runs it multiple times with different credentials to cover all three perspectives. The tool does not compare across authentication levels internally — that composition is left to the operator.