IDOR
Also called: Insecure direct object reference
Insecure Direct Object Reference: reaching another user's data by changing an ID in a URL or request.
Definition
If the server doesn't check that the logged-in user owns the requested object, changing /orders/1042 to /orders/1043 shows someone else's order. Test only with your own test accounts.
In practice
Logged in as test user Anna, you open /invoices/88 and see test user Ben's invoice.
Learn it in context
Lessons that use this term.