IDOR: أكثر أخطاء الـ API شيوعًا

في هذا الدرس

recognize and test for insecure direct object references.

الموضوعات المخطط لها

• IDOR: the API takes an ID from the client and returns the object without checking it belongs to the caller.
• Attack: log in as customer A, change /orders/101 to /orders/102.
• Hard-to-guess IDs (UUIDs) help a little but are not a fix.
• Broken access control is the top item on the OWASP Top 10 (verify the current edition before recording).
• Test it: two customers, A requests B's resource, expect 404.