VibeSecurity

Access and identity

What is IDOR (Insecure Direct Object Reference)?

IDOR is an access control flaw where changing an identifier in a request, such as an order number in a URL, lets one user view or edit another user's data because the server never checks who owns it.

Suppose your app loads an invoice from a link ending in an id. If the server returns whatever record matches that id without checking that it belongs to the logged-in user, anyone can change the number and read other people's invoices. The id is not the problem; the missing ownership check is.

This is one of the most common flaws in AI-built apps, because generated endpoints often fetch by id and stop there. It hides easily: the app works perfectly for the developer, who only ever requests their own records. Switching to random ids makes guessing harder but does not fix it.

On every endpoint that takes an id, check on the server that the record belongs to the caller, or scope the query by user. With Supabase, do this through Row Level Security policies so the database enforces it even when application code forgets.

Scope the query to the caller
select * from invoices where id = $1 and user_id = $2;

Related terms

Sources

  1. 1.OWASP Top 10 A01: Broken Access Control