Q7 of 24 · Security
How do you test for broken access control and IDOR vulnerabilities?
Short answer
Short answer: Insecure Direct Object References allow users to access resources by guessing or incrementing identifiers. Test by authenticating as User A, capturing a resource URL or ID, then authenticating as User B and requesting that resource. Any 200 response with User A's data is a failure.
Detail
Broken access control is the OWASP #1 risk (2021). It covers both horizontal privilege escalation (User A accessing User B's data at the same permission level) and vertical privilege escalation (a regular user accessing admin functionality).
IDOR test process:
- Create two test accounts (User A and User B) with the same role.
- As User A, create or access a resource (order, profile, document). Capture the resource identifier from the URL or response body.
- Log out. Authenticate as User B.
- Request the resource using User A's identifier (
GET /api/orders/12345). - Assert: 403 Forbidden (not 404, not 200 with User A's data).
Vertical escalation test process:
- Identify admin-only endpoints from the API documentation, network traffic, or JavaScript source.
- Make requests to those endpoints using a regular-user session token.
- Assert: 403 Forbidden. 404 is acceptable if the endpoint existence is hidden, but 200 is a failure.
Systematic coverage: don't test a sample — test every endpoint. Generate a matrix of (endpoint, method, role) and automate it. A parameterised API test that sends requests to every endpoint with every role and asserts the expected HTTP status code is the most thorough approach.
Common patterns to find: sequential integer IDs (/orders/1001, /orders/1002), UUIDs predictably derived from user data, and object IDs exposed in JavaScript bundles or HTML comments.