What is IDOR (Insecure Direct Object Reference) and how do you prevent it?

Summary

IDOR (now called Broken Object Level Authorization in APIs) happens when an endpoint trusts a client-supplied ID without checking that the current user may access that object, e.g., GET /invoices/1043 returning someone else's invoice.

Longer Answer

Prevent it by scoping every query to the caller (WHERE id = :id AND tenant_id = :tenant), or checking ownership/permission after loading, in a central place (policy layer, repository). Random IDs (UUIDs) make guessing harder but are not access control. It's the #1 risk in the OWASP API Security Top 10.

Code Example

# FastAPI: scope the lookup to the current user's tenant
@router.get("/invoices/{invoice_id}")
async def get_invoice(invoice_id: int, user: CurrentUser, db: DbSession):
    invoice = await db.scalar(
        select(Invoice).where(Invoice.id == invoice_id, Invoice.tenant_id == user.tenant_id)
    )
    if invoice is None:
        raise HTTPException(404)  # don't reveal that it exists elsewhere
    authorize(user, "invoice:read", invoice)
    return invoice

Key Points

• Never trust client-supplied IDs
• Scope queries to the caller/tenant
• Central policy checks
• UUIDs ≠ authorization