Insecure Direct Object Reference (IDOR)

Also Known As

TL;DR

Explanation

IDOR occurs when an application exposes internal object identifiers (database IDs, filenames) directly in requests and does not verify that the requesting user is authorised to access that object. Example: /invoice?id=1234 — incrementing the ID to 1235 returns another user's invoice. Prevention: always verify that the authenticated user owns or has permission to access the requested resource, server-side, on every request.

How It's Exploited

Diagram

flowchart TD
    USER2[Logged in as User 42] --> REQ3[GET /api/invoices/100]
    REQ3 --> CHECK2{Check: does user 42<br/>own invoice 100?}
    CHECK2 -->|no check!| RETURN2[Returns invoice 100<br/>belongs to user 99!]
    subgraph Fix3
        AUTH3[Authorisation check<br/>SELECT WHERE id=100 AND user_id=42]
        ZERO[0 rows = 404 Not Found<br/>never reveal resource exists]
    end
style CHECK2 fill:#f85149,color:#fff
style RETURN2 fill:#f85149,color:#fff
style AUTH3 fill:#238636,color:#fff

Common Misconception

Why It Matters

Common Mistakes

• Assuming sequential IDs are "hard to guess" — automated tools enumerate thousands of IDs per second.
• Checking authentication but not ownership — verifying a user is logged in does not verify they own the resource.
• Using UUIDs and believing that makes IDOR impossible — obscurity without authorisation checks is not security.
• Only protecting read endpoints and forgetting update and delete routes.

Code Examples

// No ownership check — any user can view any order
public function show(int \$orderId): JsonResponse {
    return response()->json(Order::findOrFail(\$orderId));
}

public function show(int \$orderId): JsonResponse {
    \$order = Order::findOrFail(\$orderId);

    // Enforce ownership — compare to authenticated user
    if (\$order->user_id !== auth()->id()) {
        abort(403); // Forbidden — not just 404
    }

    return response()->json(\$order);
}

// Or scope query to current user (prevents the object being fetched at all)
\$order = auth()->user()->orders()->findOrFail(\$orderId);

References

• ↗ https://owasp.org/www-community/attacks/Insecure_Direct_Object_Reference_Prevention_Cheat_Sheet
• ↗ https://cwe.mitre.org/data/definitions/639.html

Tags

Related Terms