IDOR
Insecure Direct Object References (IDOR) let users access objects they are not entitled to via predictable IDs, due to missing ownership checks.
Purpose
To understand the unauthorized access caused by predictable object IDs without authorization checks and the defenses; a common API vulnerability.
Mechanism
An API such as /api/orders/123 uses the object ID directly with no ownership check; attackers enumerate IDs to access other users orders. Defenses: session-based ownership checks, unpredictable IDs (UUIDs), indirect references.
Use cases
- API privilege escalation defense
- Object authorization audit
- IDOR vulnerability
Related tools
HTTP Status Codes
Reference table of common HTTP status codes (1xx-5xx) with names, categories, and descriptions. Free, private, and 100% client-side. TOOL
URL Parser
Parse a URL into its components: protocol, host, path, query, hash, port, username, and password. Free, private, and 100% client-side. TOOL