Glossary term
What is IDOR (Insecure Direct Object Reference)?
IDOR stands for Insecure Direct Object Reference.
In Backend in Depth
Someone changes an ID in a URL and sees another person's data, because the server never checked who owns it. Also called BOLA.
Learn it properly · Backend in DepthLesson 6: Authentication and Authorization on the ServerPassword hashing, session stores, checking JWTs properly, role-based vs attribute-based access control, and checking ownership on every resource.In Security for Developers
A bug where the server uses an ID from the request, like /notes/2, to fetch a record without checking that the caller may see it.
Learn it properly · Security for DevelopersLesson 4: Access Control: IDOR, Roles and Mass AssignmentThe number one web risk: checking who you are but not what you may do. IDOR with a real example, deny by default, roles and ownership checks, and mass assignment.In Next.js App Router
A bug where the client sends an id and the server acts on that row without checking the caller owns it.
Learn it properly · Next.js App RouterLesson 3: Server Actions, Forms and MutationsForms that call server functions, validation, pending and error states, revalidating after a change, and the security rules for actions.