Insecure Direct Object Reference (IDOR)

When an endpoint trusts a client-supplied object ID without checking that the requester actually owns it, changing one number in a request exposes every other record in the system.

Sequential or guessable IDs (/invoices/1042) turn enumeration into a two-minute exercise

Authorization must be checked per-request, not assumed from a valid session token alone

Authentication answers "who are you"; authorization answers "are you allowed to see THIS record" — IDOR is a failure of the second, not the first

Random, non-sequential identifiers (UUIDs) slow enumeration but do not replace an ownership check

Want this flow explained in detail as it plays?

GET/api/invoices/1042

Headers

Host:app.flowground.dev

Authorization:Bearer <valid-session-token-for-user-88>

Body

Stuck? Try a hint

Defense in depth

Revealed once you've worked through the hint ladder above — try the attack yourself first.

Vulnerable vs. Fixed

app.get("/api/invoices/:id", requireAuth, async (req, res) => {
  const invoice = await db.invoices.findById(req.params.id);
  res.json(invoice); // never checked invoice.userId === req.user.id
});