This lesson focuses on access control. Practice only in your own local application or an environment where you have explicit permission. IDOR occurs when the server does not check a user’s authorization for the requested object.
Signing in is not enough
Imagine two test accounts, A and B, each with a private note. Signing in as A must not grant access to B’s note. Knowing its ID does not prove ownership. Random IDs are not a substitute for permission checks.
Enforce access on the server
In this pseudocode, the user comes from trusted authentication state. The lookup is restricted by both object ID and owner ID. Shared resources need additional rules that match the product’s access policy.
user = authenticated_user()
note = find_note(id=requested_id, owner_id=user.id)
if note is None:
return not_found()
return notePractice with two test accounts
Create two accounts and synthetic notes. Account A should read its own note and be denied access to B’s. Repeat for update and delete operations. Record the expected and actual results, and repeat the tests after fixing the access checks.
Check your understanding
What fixes the root cause: hiding a button, making IDs longer, or checking permission for every object on the server?
Check permission for each object and operation on the server.