IDOR
Insecure direct object references — when an app trusts an ID and forgets the ownership check.
IDOR (Insecure Direct Object Reference) is an access-control flaw: the app exposes a reference to an object — a row, a file, a user — and fails to verify the requester is allowed to access it.
Spot the pattern
Anywhere an identifier appears in a request, ask “what if I change it?”
GET /api/invoices/1043 HTTP/1.1Cookie: session=<your-session>GET /api/invoices/1042 HTTP/1.1Cookie: session=<your-session>If the second request returns someone else’s invoice, the endpoint trusts the ID without an ownership check.
Where to look
- Numeric IDs in paths/queries (
?id=,/users/42). - IDs in JSON bodies, including nested ones.
- Filenames in download/export endpoints.
- IDs in hidden fields and API responses you can replay.
The fix
Authorize every request server-side, scoped to the authenticated user:
SELECT * FROM invoices WHERE id = ? AND owner_id = :current_user;