Your client portal shows an invoice at an address like /invoice?id=1001. What happens if a logged-in client changes that to 1002? In too many web apps, they see someone else's invoice. This flaw is called an insecure direct object reference, or IDOR, and it's one of the most common causes of data leaks in business web apps.
Why it happens
The app checks that you're logged in, but not that the record you asked for belongs to you. Records are numbered in order, so guessing other numbers is easy, and attackers can automate it to download thousands of records in minutes.
How to prevent it
- Check ownership on every request. The server must confirm the record belongs to the logged-in user or their organization before returning it.
- Use unguessable identifiers such as long random IDs instead of 1001, 1002, 1003. This is a second layer, not a replacement for the check.
- Test for it. Automated scanners often miss IDOR, because the page looks normal. A manual penetration test logs in as two users and tries to cross between them.
If you run a client portal, booking system or custom app, our penetration tests check for IDOR and the rest of the OWASP Top 10.