Web Security · Middle · Question 57 of 75

What is IDOR (insecure direct object reference)?

1Using auto-increment IDs in a database
2Referencing objects by their memory address
✓Correct answer: Changing an ID in a request, like /api/orders/1002, gives access to another user's data because ownership isn't checked

Explanation

Random UUIDs make guessing harder but don't fix the bug. Every request must check that the current user may access that object.

Further reading

Test yourself

Take the Web Security · Middle quiz: questions and options are shuffled, and you get a review of your mistakes at the end.