Insecure direct object reference

{{short description|Type of access control vulnerability in digital security}}

Insecure direct object reference (IDOR) is a type of access control vulnerability in digital security.{{Cite web|title=Insecure direct object references (IDOR) {{!}} Web Security Academy|url=https://portswigger.net/web-security/access-control/idor|access-date=2021-01-12|website=portswigger.net}}

This can occur when a web application or application programming interface uses an identifier for direct access to an object in an internal database but does not check for access control or authentication. For example, if the request URL sent to a web site directly uses an easily enumerated unique identifier (such as http://example.com/doc/1234), that can provide an exploit for unintended access to all records.

A directory traversal attack is considered a special case of an IDOR.{{Cite web|last=Karande|first=Chetan|date=|title=Securing Node Applications - 4. Insecure Direct Object References|url=https://www.oreilly.com/library/view/securing-node-applications/9781491982426/ch04.html|access-date=2021-01-12|website=www.oreilly.com|language=en}}

The vulnerability is of such significant concern that for many years it was listed as one of the Open Web Application Security Project’s (OWASP) Top 10 vulnerabilities.{{Cite web|last=Solomon|first=Howard|date=2021-01-12|title=Common development error likely led to huge Parler data theft, says expert {{!}} IT World Canada News|url=https://www.itworldcanada.com/article/common-development-error-likely-led-to-huge-parler-data-theft-says-expert/440646,%20https://www.itworldcanada.com/article/common-development-error-likely-led-to-huge-parler-data-theft-says-expert/440646|access-date=2021-01-12|website=www.itworldcanada.com|language=en-US}}{{Dead link|date=August 2023 |bot=InternetArchiveBot |fix-attempted=yes }}

You can change consecutive IDs into Dark Keys using several techniques.{{Cite web |last=Contieri |first=Maximiliano |date=2025-05-17 |title=Refactoring 028 - Replace Consecutive IDs with Dark Keys |url=https://maxicontieri.substack.com/p/refactoring-028-replace-consecutive |access-date=2025-05-17 |website=Clean Code Cookbook}}