Broken access control is the most common serious web vulnerability. The application authenticates the user, then forgets to check whether that user may perform the requested action.
Horizontal and vertical
- Horizontal: user A accesses user B's data at the same privilege level. Example: changing
/invoices/1042to/invoices/1043. - Vertical: a normal user performs an administrator action. Example: calling an admin API directly.
Both are authorisation failures, not authentication failures. The user is legitimately logged in; they are just not allowed to do this.
Insecure direct object references
An IDOR occurs when the application uses a client-supplied identifier without checking ownership.
GET /api/documents/8831
If the server returns the document for any logged-in user, the object reference is insecure. Changing the number is enough.
Defences:
- Check ownership and permission server-side for every object.
- Prefer unpredictable identifiers only as defence in depth, never as the only control.
- Centralise authorisation so it is hard to forget.
- Test with two accounts in a legal lab.
Continue this lesson in the player
A free account unlocks the full lesson, the five-question knowledge check, progress tracking, notes and the completion certificate.