Direct answer
An export has several authorization boundaries: who can start it, which data it contains, who can see the job and who can download the result. Test each with owned fixtures.
Prepare two tenants
Create isolated test tenants A and B with distinctive synthetic records and dedicated users. Document which roles may create exports, see job status and download results, including any approved support or sharing access.
Reference: OWASP Authorization Cheat Sheet.
Check export creation
Create a small export as A and confirm it contains only A's permitted test records. Attempt the same operation as a role that policy denies, and inspect whether a job was queued even if the API returned an error.
- Use small fixtures without real personal data.
- Record job identifiers and ownership without sharing live download URLs.
- Avoid large exports or load testing without a separate agreement.
Check status and download
With B's session, request A's controlled job status and result route. Verify no private status, file contents or signed link is returned. Test any legitimate shared support workflow as a positive control.
Retest asynchronous paths
After a fix, repeat creation, polling and download with allowed and denied users. Confirm old generated links and cached files follow the documented lifetime and that the owner can still obtain the correct export.
Assessment limits
Job queues, object storage and application routes can apply different controls. One export type does not establish isolation for every report or background task.
Frequently asked questions
Does hiding the export button protect the generated file?
No. Job status and download endpoints need their own authorization checks.
Does a denied response prove no job was started?
Inspect the controlled queue or job state; asynchronous work may already have been created.
Primary sources and further reading
These guides combine published security guidance with practical assessment planning. Adapt checks to the owner's policy, environment, and authorized scope.
This guide was prepared with AI assistance using the linked sources and illustrative examples. Check current vendor guidance and your environment before making changes.