System Design · Middle · Question 55 of 75

What is IDOR, and how is it prevented?

GET /api/invoices/1043   // user changes the id to 1044

✓Correct answer: Insecure Direct Object Reference: the server must check that the current user may access each requested object
2Using UUIDs instead of numbers is enough
3Hiding ids in the UI is enough

Explanation

Unguessable ids reduce enumeration but don't replace authorization checks on every object.

Further reading

OWASP: Insecure Direct Object Reference Prevention ↗

Test yourself

Take the System Design · Middle quiz: questions and options are shuffled, and you get a review of your mistakes at the end.