Beginner LevelWeb Security & Cyber Defense
What is Broken Access Control and how do IDOR (Insecure Direct Object Reference) vulnerabilities occur?
❓ Interview Prompt: Explain Broken Access Control (#1 OWASP risk), IDOR, horizontal vs vertical privilege escalation, and resource ownership checks.
Broken Access Control is currently the #1 vulnerability on the OWASP Top 10:
Insecure Direct Object Reference (IDOR):
Occurs when an application uses user-supplied keys to access database records directly without verifying ownership or permissions:
•
Exploit: User 10 logged in calls 'GET /api/v1/invoices/1001'. User 10 changes the URI to 'GET /api/v1/invoices/1002' and reads User 11's private invoice payload because the server checked authentication but failed to verify resource ownership!
Code Implementation Example
typescript
app.get('/api/v1/invoices/:id', async (req, res) => {
const invoice = await db.invoice.findUnique({ where: { id: req.params.id } });
// ❌ IDOR Vulnerability: Missing ownership check!
// return res.json(invoice);
// ✅ Secure: Check that logged-in user owns requested object!
if (invoice.userId !== req.user.id) {
return res.status(403).json({ error: 'Forbidden: Access Denied' });
}
res.json(invoice);
});💡Preventing IDOR by enforcing user resource ownership checks.
🎯 Interview Key Takeaway
Always verify that the authenticated user has explicit permission to access the target object ID.
#Access Control#IDOR#OWASP#Beginner
Back to all Web Security & Cyber Defense Questions→