Insecure Direct Object References (IDOR)

Target Recon Testing Checklist

• 1.Map parameter IDs in REST endpoints (/api/profile/9982).
• 2.Test ID swapping - replace your ID with a neighboring ID.
• 3.Check UUID parameters - test if they are predictable or leak in directory listings.
• 4.Examine multi-tenant access - can Tenant A access Tenant B assets using references?
• 5.Check secondary actions (edit, delete, updates) which often miss auth filters.

Testing Parameters & Payloads

GET /api/user/profile?id=10001 (change id)

POST /api/invoices/download [body: {"invoice_id": 998}]

DELETE /api/posts/delete/312

Mitigation & Safe Development Guidelines

• Perform user authorization checks on every state change and fetch event.
• Use indirect object references (mapping tables or temporary hashes) instead of exposing database keys.
• Implement robust Access Control Lists (ACL) matching user roles against resource owners.