thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Application & OT Security · Foundational

Insecure Direct Object Reference (IDOR)

An access control flaw where an application exposes an internal object identifier and does not verify the user is authorized for that object.

Definition

Users change IDs in URLs, forms or API calls to access other users' records or files. Fixes include per-object authorization checks, indirect reference maps and unpredictable identifiers as defense in depth. IDOR is part of Broken Access Control and equals BOLA in APIs.

Example

Changing invoice_id=500 to 501 downloads another customer's invoice.

Exam tip

Fix with an authorization check, not by hiding or encrypting the ID alone.

Related terms