139
insecure direct object reference
also IDOR
The id in the URL is a guess. Authorization is per object, not “any logged-in user.”
What is insecure direct object reference?
IDOR is access control that trusts an identifier the client sends: `/invoices/42` returns whoever asks. The fix is an authorization check that the caller owns that row, or an unguessable id plus the check. Unguessable ids alone are not the fix.
Why does insecure direct object reference matter when vibe coding?
Models add login, then `SELECT * FROM invoices WHERE id = ?` and return the row. The next user changes 42 to 43. The check is: this session owns this id.
How do you do insecure direct object reference?
Every read and write by id checks ownership on the server. A test logs in as someone else and requests the id. 404 or 403, never the body.
How do you ask a model for insecure direct object reference?
Close IDOR on (route). The session must own (id). Check on the server for read and write. Add a test where a second user requests the first user’s id and is refused. Do not rely on hiding the link.
What goes wrong with insecure direct object reference?
Checking ownership on GET and forgetting the update and delete. The form still posts.