> For the complete documentation index, see [llms.txt](https://0xhunterr.gitbook.io/the-nen-book/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://0xhunterr.gitbook.io/the-nen-book/web_appsec/app_logic_errors.md).

# App\_Logic\_Errors

## simple scenario

the App use the MFA to login users using multiple ways not just the password so let's assume a normal authentication flow would look like this:\
Step 1 (Password Check) -> Step 2 (MFA) -> Step 3 (Security Questions)

* step 1 the user will provide the pass at `https://example.com/login/`
* step 2 to provide the MFA code at `https://example.com/mfa/`
* step 3 security question at `https://example.com/security_questions/`\
  what if u manipulate the URL and access the `https://example.com/security_questions/` directly without providing the MFA code? if it worked then it's a broken logic and access control