What is an IDOR vulnerability, and how would you prevent it in an API?

Prevent IDOR with resource ownership checks

Explains insecure direct object reference risks and how APIs enforce ownership, tenant scope, and authorization per resource.

1Say itAnswer out loud first

2CompareCompare with Core answer

3RefineRefine with Stronger and Advanced

TL;DR

An IDOR happens when the API accepts a resource id and returns or changes that resource without checking whether the caller is allowed to access it. The fix is not just using GUIDs. The API must check ownership, tenant membership, role, or capability against the resource before returning data or applying changes.

Full answer below

Practice focus

Resource ownership, object identifiers, tenant scope, policy checks, query filtering, and safe not-found behavior.

Answer first

Answer path

Core answer first, then checkpoints toward a stronger answer.

Start
Core answer
Start here. This is the direct spoken answer to practice first.
Why this question matters
IDOR is one of the most practical API security bugs: the caller changes an id and accesses another user's data.
An IDOR happens when the API accepts a resource id and returns or changes that resource without checking whether the caller is allowed to access it. The fix is not just using GUIDs. The API must check ownership, tenant membership, role, or capability against the resource before returning data or applying changes.
Checkpoint
Stronger answer
Optional upgrade with examples, trade-offs, and sharper phrasing.
I would build the check into the data access or policy path so it is hard to forget. For example, queries can filter by both resource id and current tenant or owner. If the resource exists but the user cannot access it, the API may return 404 for privacy-sensitive resources or 403 where revealing existence is acceptable. The decision should be consistent and documented.

Review signals

Use these to catch weak phrasing, shallow reasoning, and risky claims.

Common mistakesCandidateCommon mistakesMistakes that weaken the answer or signal shallow understanding.Open details

Details

Assuming GUIDs are enough protection.
Checking ownership in the UI only.
Filtering by id but not tenant or owner.
Forgetting bulk/export endpoints.

What is an IDOR vulnerability, and how would you prevent it in an API?

Practice focus

Answer path

Why this question matters

Review signals

Follow-up prompts

Continue practice

Go deeper

Tech stacks

Skill areas

Suggest an improvement