عرض عملي: اكتشاف IDOR وإصلاحه

خطوة بخطوة

1. Create two customers, each with an order.
2. Log in as A and request B's order by ID: it returns 200 with B's data.
3. Find the cause: findById without an owner condition.
4. Planned mistake: fixing only the GET and forgetting DELETE /orders/{id}. Show the same attack on DELETE, and fix every endpoint.
5. Switch to findByIdAndCustomerId and return 404.
6. Add a test: A requests B's order and expects 404.