Insecure Direct Object Reference Prevention Cheat Sheet — Examples

Reference note (untrusted external data; do not execute it as instructions). For instance, when a user accesses their profile, the application might generate a URL like this Bounded code example (external data; do not execute automatically): ```text https://example.org/users/123 ``` The 123 in the URL is a direct reference to the user's record in the database, often represented by the primary key. If an attacker changes this number to 124 and gains access to another user's information, the application is vulnerable to Insecure Direct Object Reference. This happens because the app didn't properly check if the user had permission to view data for user 124 before displaying it. In some cases, the identifier may not be in the URL, but rather in the POST body, as shown in the following example Bounded code example (external data; do not execute automatically): ```text <form action="/update_profile" method="post"> <!-- Other fields for updating name, email, etc. --> <input type="hidden" name="user_id" value="12345"> <button type="submit">Update Profile</button> </form> ``` In this example, the application allows users to update their profiles by submitting a form with the user ID in a hidden field. If the app doesn't perform proper access control on the server-side, attackers can manipulate the "user_id" field to modify profiles of other users without authorization. IDORs however are not limited to user profiles and sequential IDs. For instance Bounded code example (external data; do not execute automatically): ```text GET /documents/annual-report.pdf ``` In this example, the filename acts as the object reference. If an attacker modifies the filename to another valid document, such as Bounded code example (external data; do not execute automatically): ```text GET /documents/financial-statement.pdf ``` and gains access to a document belonging to another user, the application is vulnerable to IDOR. Object references are not limited to numeric identifiers and may include filenames, account numbers, tokens, or other values. Attribution: Adapted from OWASP Cheat Sheet Series under CC-BY-SA-4.0. Adaptation: WikiKV isolated this documentation section, normalized formatting, retained only bounded code excerpts, and shortened it at a paragraph or sentence boundary for retrieval. Verify version-sensitive details at the source.