A4: Insecure Direct Object References · 2013

Direct object references allow access to other users' resources when the server trusts an identifier without verifying authorization.

Summary

Direct object references allow access to other users' resources when the server trusts an identifier without verifying authorization.

How the attack works

A user changes an object identifier in the API; the server skips authorization and returns another person’s data.

Example

Vulnerable · Pseudocode

GET /api/invoices/1043
Cookie: session=alice
return invoices.find(id)

Fix: Check on the server that the invoice belongs to the session user.

Prevention

Check authorization for every requested object.
Avoid relying on unpredictable identifiers as a security control.
Scope queries to the user, organization or tenant.

Lineage

2013 · A4: Insecure Direct Object References Merged into Broken Access Control
2013 · A7: Missing Function Level Access Control Merged into Broken Access Control
2017 · A5: Broken Access Control Moves up to rank 1 in 2021
2021 · A01: Broken Access Control Moves up from A5:2017
2021 · A10: Server-Side Request Forgery (SSRF) New in 2021
2025 · A01: Broken Access Control Consolidates SSRF and remains at rank 1

2013:A4 → 2017:A5: IDOR is integrated into Broken Access Control.
2013:A7 → 2017:A5: Missing Function Level Access Control is integrated into Broken Access Control.
2017:A5 → 2021:A01: Broken Access Control moves up from rank 5 to 1.
2021:A01 → 2025:A01: Broken Access Control remains at rank 1.
2021:A10 → 2025:A01: SSRF is consolidated into Broken Access Control.

Sources

Open official source ↗

Buy me a coffee