IDOR: the most common API bug
On This Lesson 4 topics
This lesson is planned. The outline below lists the topics it will cover. The full lesson has not been published yet.
In this lesson
recognize and test for insecure direct object references.
Planned topics
- IDOR: the API takes an ID from the client and returns the object without checking it belongs to the caller.
- Attack: log in as customer A, change
/orders/101to/orders/102. - Hard-to-guess IDs (UUIDs) help a little but are not a fix.
- Broken access control is the top item on the OWASP Top 10 (verify the current edition before recording).
- Test it: two customers, A requests B's resource, expect 404.
Draft outline details
Demonstration
a request pair: GET /orders/101 (own, 200) and GET /orders/102 (other's, should be 404).
Check your understanding
Does switching to UUIDs fix IDOR?
Show answer
No. You still need an ownership check.
Practice
Apply this lesson with the module's lab, exercises and quiz.
Marking a lesson complete is optional and you can undo it any time. Your progress stays in this browser.