IDOR: the security hole AI leaves in your routes

· Published · 1 min read

AI makes a common security blunder: IDOR (Insecure Direct Object Reference).

What is it?

You ask the AI for a route that fetches some data. Say, an invoice.

The AI creates a route that takes the invoice id and returns it. Great…

… except it forgets to check that the invoice actually belongs to the authenticated user… or worse, that the user is authenticated at all.

Why? Because you didn’t ask for it.

And AI codes what you ask for, not what you forget to ask for.

The result: the id in the URL acts as proof of identity. Except an id is just a number. Anyone can type another one.

The test to run on your app

  1. Create 2 accounts on your own app.
  2. Log in with account A.
  3. In the URL, replace your id with account B’s.

Can you see B’s data?

⇒ Everyone sees everything. Your customers see other customers’ invoices.

That flaw is among the first I probe for when I open an app’s code.

Sources