Insecure Direct Object References

Putting database identifiers in URLs is normal. It becomes unsafe when the server uses a client-controlled identifier to load an object without checking whether the requester is allowed to access it.

When broken access control involves an object identifier, it's called an Insecure Direct Object Reference (IDOR).

The fix is the same: check permissions on the server before returning any object data. Database IDs are not secrets, so just because an incoming request knows a user's order ID does not mean that user is allowed to see it.

app.get("/api/orders/:id", requireAuth, async (req, res) => {
  const order = await db.orders.findById(req.params.id);
  if (!order || order.ownerId !== req.user.id) {
    return res.status(404).json({ error: "Not found" });
  }

  res.json(order);
});

Another strong pattern is to include ownership directly in the database lookup. You still need to handle a missing result, but an unauthorized order never leaves the database:

SELECT *
FROM orders
WHERE id = ? AND user_id = ?