Insecure Direct Object Reference
High · Access Control · OWASP A01:2021 · CWE-639
Description
Changing an identifier exposes other users' data.
Root cause
Missing per-object authorization checks.
Impact
Mass data exposure.
Detection
Authorization tests with two accounts, access logs.
Mitigation
Enforce ownership checks server-side on every request.
Secure coding
Check "can this user access this object?" in every handler.
Safe lab example
OWASP Juice Shop basket challenge
Practise related skills in Labs or deepen on Academy library.