IDOR Playground
A fake "my invoices" page. Change one number in the URL and see whose data you were never supposed to see.
Insecure Direct Object Reference is the bug where an application checks that you are logged in but forgets to check that the record you asked for is yours. Change a number in the URL, get someone else's data. It is trivially simple and enormously common.
How to use it
- Open your own invoice and note the identifier.
- Change it.
- Read data that was never meant for you.
What to take away
Authentication is not authorisation
Knowing who you are says nothing about what you may see. The check must happen per object, on every request, on the server.
Unguessable IDs are not a fix
A UUID makes the bug harder to find by hand, not harder to exploit once found — and IDs leak through exports, emails and referrers constantly.
Frequently asked questions
Why is IDOR so common?
Because the missing code is invisible. Nothing breaks, no test fails, and the feature works perfectly for the developer testing with their own account.
How is it fixed?
Every request that names an object must verify that the authenticated user owns or may access that specific object, server-side, before returning anything.
Is IDOR the same as BOLA?
Effectively yes. BOLA — Broken Object Level Authorization — is the API-focused name, and it sits at number one on the OWASP API Security Top 10.
Where this fits in the course
This security lab pairs with Path 11 — Web Security — see all 26 learning paths.
It runs entirely in your browser: nothing is uploaded, no account is needed, and it is free.
Related
- BOLA/BFLA Playground — A fake employee-directory API. Read a record that isn't yours, then call an admin-only action with no admin role at all.
- Mass Assignment Toy — A "update my profile" endpoint that binds whatever JSON you send straight to your account. Find the field that shouldn't be writable.
- GraphQL Introspection Abuse — A single /graphql endpoint. Use introspection to map the full schema, then query a field the UI never shows you.
- Vulnerable Web App — A tiny deliberately-broken app for practicing XSS and login-bypass. Runs entirely in-browser; no server to attack, nothing to install.