What is IDOR?
A bug where changing an id in an address (105 instead of 104) shows someone else's data, because the app never checks the owner.
Where IDOR goes wrong in real apps
Each of these is a short scenario built from a real failure in an app made with AI. Read the answer here, or walk through it yourself in about four minutes.
Who may see what · 4 minutes · Free
Invoice 105
Your invoicing app is live. A customer emails: they changed a number in the address bar and saw someone else's invoice.
Walk it, freeWhat is an IDOR vulnerability?
An IDOR (insecure direct object reference) is when an app loads a record by an id from the URL or request without checking that the signed-in user owns it. Changing /invoices/104 to /invoices/105 then shows someone else's invoice. The fix is to scope every query to the current user on the server.
Related terms
- Endpoint
- One specific address on your server that does one job, like /api/invoices. Each one needs its own safety checks.
- Request
- A message your browser (or any program) sends to a server asking for something: 'give me invoice 105' or 'save this profile'.
- Server
- A computer that runs your app's code out of sight. Users can't change what happens there, which is why checks belong there.
- Browser
- Chrome, Safari and friends. Everything that runs here is visible to, and changeable by, the person using it.
- Query
- A question your app asks the database, such as 'give me all orders for this customer'.
- Authentication
- Checking who someone is, usually by signing in.