IDOR · Insecure Direct Object Reference
One number changed. Data stolen.
You don't need to be a seasoned attacker. By changing a single digit in the URL, anyone can access another user's data: salaries, bank details, medical information.
- ≈ 3 min
- Intermediate level
- Broken Access Control
- URL tampering
- OWASP A01
Step-by-step simulation
Follow the attack step by step
Alice Martin
Marketing Manager · #1042
You're viewing your payslip
Logged in as Alice Martin - Marketing Manager
A URL that contains your ID
Your HR portal displays your data via a number directly present in the page address. This number identifies your record in the database. Nothing unusual here.
Key figures
Access control, the web's #1 flaw
- OWASP Top 10
#0
Broken Access Control- Of code to fix it
0 line
a server-side authorization check- Alert generated
0
The attack is invisible- CNIL fine (SERGIC)
€0K
access flaw - 2019
Protection
How to protect yourself
IDOR isn't a URL bug: it's a missing server-side authorization check.
Check every access
On every request, the server verifies the signed-in user is actually allowed to access the requested object.
Unpredictable identifiers
UUIDs instead of sequential numbers slow down enumeration, without replacing access control.
Deny by default
Centralize authorization rules and reject anything that isn't explicitly allowed.
Detect enumeration
Alert on bursts of requests to successive identifiers and test permissions before release.
FAQ
Frequently asked questions
What is an IDOR vulnerability?
IDOR (Insecure Direct Object Reference) is an authorization vulnerability that allows access to other users' resources by modifying an identifier in the URL or request (e.g. /api/documents?id=1234 → /api/documents?id=1235). It exposes personal data, invoices, or medical records depending on the context.
How does an IDOR attack work?
The attacker identifies a predictable parameter in a URL or API request (a number, an incremental UUID) and changes it to access other users' resources. Without a server-side authorization check, the system returns any user's data to anyone who knows their identifier.
How do you fix an IDOR vulnerability?
To fix IDOR: systematically verify server-side that the authenticated user owns the requested resource, use unpredictable identifiers (random UUID v4 rather than sequential integers), implement role-based access control (RBAC), and test with tools like Burp Suite.
Is IDOR in the OWASP top list?
Yes, IDOR falls under category A01:2021 - Broken Access Control in the OWASP Top 10 2021, ranked first. Flaws of this kind have caused major data leaks at Facebook, Instagram, Parler, and numerous healthcare platforms.
I found a flaw like this on a site: what should I do?
Stop at the first finding: browsing other people's records is unauthorized access, even without intent to harm. Report the flaw to the site (security@ address or security.txt file) or to your national CERT, and keep a timestamped copy of your report.
Going further
Tools and reading related to this module
Train your teams with an expert
Tailored awareness workshops, attack simulations and training to anchor the right reflexes in your organization.