IDOR/BOLA: when the ID is the only defence

December 28, 2025 · 1 min read · #web #idor #access-control

Insecure Direct Object Reference (or Broken Object Level Authorization) is a missing authorization check at the resource level. The server verifies who you are but not whether you may see that object.

GET /api/invoice/1001   -> your invoice
GET /api/invoice/1002   -> someone else's (accessible!)

Sequential IDs make enumeration trivial. UUIDs hide but do not authorize: they are still IDOR if the check is missing.

Defence

On every resource access verify it belongs to (or is visible to) the authenticated user: WHERE id = ? AND owner_id = ?. Centralize the check, do not leave it to each endpoint. Unpredictable IDs are defence in depth, not authorization.

« back to home