insecure direct object reference
An insecure direct object reference exposes an object without checking access to it.
Use this when A request contains the ID of an object to read, edit, or delete.
without the term
“If I change the invoice number in the URL from 1001 to 1002, I can see another customer's invoice. Can you fix this everywhere it might happen?”
with the term · How do you ask a model for insecure direct object reference?
Check object authorization on all operations for this resource. Verify another user cannot read, update, or delete it by changing the ID.
What is insecure direct object reference?
The endpoint loads a record by the id in the URL or body without checking that the caller may access it, so changing the id exposes someone else's data.
Why does insecure direct object reference matter when vibe coding?
An agent may check ownership on one endpoint and omit it on another.
How do you do insecure direct object reference?
Apply the resource authorization rule to every operation and test with two users.
What goes wrong with insecure direct object reference?
Treating an unpredictable identifier as an access-control mechanism.