Understanding IDOR: an identifier is not permission

Learn the difference between signing in and being allowed to access an object.

Lesson progress0 / 2

01 / STUDY1 / 2

Object-level authorization

This lesson focuses on access control. Practice only in your own local application or an environment where you have explicit permission. IDOR occurs when the server does not check a user’s authorization for the requested object.

Signing in is not enough

Imagine two test accounts, A and B, each with a private note. Signing in as A must not grant access to B’s note. Knowing its ID does not prove ownership. Random IDs are not a substitute for permission checks.

Enforce access on the server

In this pseudocode, the user comes from trusted authentication state. The lookup is restricted by both object ID and owner ID. Shared resources need additional rules that match the product’s access policy.

user = authenticated_user()
note = find_note(id=requested_id, owner_id=user.id)

if note is None:
    return not_found()
return note

Enroll for free to practice ↗

02 / YOUR TURN

Learning ping-pong

⌑ Practice unlocks after you mark this section as studied.

LEARNING COPILOT

✦ Your AI learning companion

Ask for a simpler explanation, another example or a hint.

Instructor’s hint

Identity and permission for each object are different.

The tutor is available to enrolled students.