IDOR
Insecure direct object reference
Common shorthand for missing authorization around a user-controlled object identifier. Random identifiers do not replace access checks.
- Defined in
- MITRE CWE-639
Covered in
Enforce authorization for every object action
Authorize the authenticated subject, requested operation, and specific resource together; a valid login or unpredictable identifier is insufficient.
Case study: First American's EaglePro document exposure (2019)
How sequential IDs in unauthenticated links exposed First American's title documents in 2019, after its own penetration test found the flaw and a clerical error let it go unfixed.
Authorization models: RBAC, ABAC, ReBAC and policy as code you can test
Translate roles, attributes and relationships into explicit subject-action-resource decisions, prevent broken object level authorization (BOLA), and verify ownership and tenant boundaries with tests.
Practice: IDOR lab: Repair an invoice authorization bug · Local project: Secure a real HTTP API