Insecure direct object reference

Insecure direct object reference (IDOR) is a type of access control vulnerability in digital security.

This can occur when a web application or application programming interface that authenticated the user to use the website, uses an identifier for direct access to an object in an internal database but does not check for access control or authentication for the file transfer. For example, if the request URL sent to a web site directly uses an easily enumerated unique identifier (such as https://example.com/document/1234), this can provide an exploit for unintended access to all records. Even if the web application uses complex identifiers, a lack of access control checks can allow an attacker to access unauthorized objects if they obtain the identifier from elsewhere.

A directory traversal attack is considered a special case of an IDOR.

The vulnerability is of such significant concern that for many years it was listed as one of the Open Web Application Security Project's (OWASP) Top 10 vulnerabilities.

Consecutive IDs can be changed into dark keys using several techniques.

In November 2020, the firm Silent Breach identified an IDOR vulnerability with the United States Department of Defense website and privately reported it via the DOD's Vulnerability Disclosure Program. The bug was fixed by adding a user session mechanism to the account system, which would require authenticating on the site first.

It was reported that the Parler social networking service used sequential post identifiers, and that this had enabled the scraping of terabytes of data from the service in January 2021. The researcher responsible for the project has said that this was inaccurate.