IDOR (Insecure Direct Object Reference)

Scenario: Accessing Another User’s Profile:
•    A website uses the following URL to display a user’s profile: https://example.com/profile?user_id=123
•    Note: If the application does not properly validate access permissions, an attacker could change user_id=123 to user_id=124 and access another user’s profile.

How to Prevent IDOR Vulnerabilities:
1. Implement Proper Access Controls: Always verify that the requesting user has permission to access the requested resource.
2. Use Indirect References: Instead of exposing raw database IDs, use random or hashed identifiers (e.g.,UUIDs).
3.Server-Side Authorization Checks: Ensure that access control checks occur on the server, not just in the front end.
4. Least Privilege Principle: Limit users’ access to only what is necessary for their role.
5. Logging and Monitoring: Track access patterns to detect and respond to unauthorized access attempts.