Insecure Direct Object Reference

Changing the ID in a URL and getting someone else’s record — the simplest serious bug on the web.

Core Principles & Analysis

• Sequential identifiers plus missing authorization checks equal a full data walk.
• Its API incarnation, broken object level authorization, tops the OWASP API Security list.
• The fix is authorization on every object access, not obscuring the identifiers.

Specifications & Metrics

• CWE: CWE-639
• IMPACT: Unauthorized data access