The Danger of IDOR

🧠 How it happens

Backend logic:

GET /api/user/123

System checks:
✔ User logged in

But misses:
❌ Is this THEIR data?

---

⚠️ Attack example

User A:

/api/profile/101

Attacker tries:

/api/profile/102

👉 Access granted → vulnerability

---

🔍 Types

Horizontal

Access same-level users

Vertical

Access admin resources (critical)

---

🚨 Real-world damage

• Personal data leaks
• Financial records exposure
• Medical records compromise

---

🛡️ Fix (CRITICAL)

✔ Authorization check

if (request.user.id !== resource.ownerId) {
  deny();
}

---

✔ Backend validation only

❌ Never trust frontend checks

---

✔ Indirect IDs (optional)

• UUID instead of 1,2,3
• But NOT a replacement for auth

---

🎯 Key takeaway

👉 Login ≠ permission
👉 Always validate ownership