API Testing · Junior · Question 60 of 75

What is an IDOR bug?

1Accessing another user's data by changing an ID in the request
2A bug where IDs are generated in the wrong order
3An error caused by sending an ID in the wrong format

Show the answer

Correct answer: Accessing another user's data by changing an ID in the request

Explanation

If /orders/1001 shows another customer's order after you change the number, authorization is broken. Always test with two users.

Further reading

Test yourself

Take the API Testing · Junior quiz: questions and options are shuffled, and you get a review of your mistakes at the end.