IDOR (Insecure Direct Object Reference)
A flaw where a system trusts an ID in a request instead of checking who's allowed to see it.
Learn it through a story
- The Bug Bounty Bet (Cybersecurity for Juniors 2, Ch 4)
- Who Goes There, and What Are They Allowed to Do? (Cybersecurity for Juniors 3, Ch 3)
Related terms
- IAM (identity and access management) The system of roles and permissions controlling who can access what in the cloud.
- Identity and access management (IAM) The discipline of managing who or what can access a system, and what they can do.
- Identity provider A central service other systems rely on to verify who someone is.
- Image scanning Automatically checking a container image's layers for known vulnerabilities.
- Impossible travel A detection technique flagging logins from two locations too far apart to reach in the time between them.
- In-app purchase Spending real money inside an app, often disguised as game currency.