Planned lessonJNR-040-L05

Demo: finding and fixing an IDOR

On This Lesson 3 topics

This lesson is planned. The outline below lists the topics it will cover. The full lesson has not been published yet.

In this lesson

exploit and fix an IDOR in Shop. Prepares JNR-040-LAB1.

Draft outline details

Create two customers, each with an order.
Log in as A and request B's order by ID: it returns 200 with B's data.
Find the cause: findById without an owner condition.
Planned mistake: fixing only the GET and forgetting DELETE /orders/{id}. Show the same attack on DELETE, and fix every endpoint.
Switch to findByIdAndCustomerId and return 404.
Add a test: A requests B's order and expects 404.

Apply this lesson with the module's lab, exercises and quiz.

Marking a lesson complete is optional and you can undo it any time. Your progress stays in this browser.