OWASP A01 · Lab Environment

Broken Access Control — IDOR Playground

A simulated employee portal for SecureBank. You're logged in as a low-privilege employee. Try changing the record ID in the address bar and see whether the server checks who's asking — or just what they asked for.

Logged in as raju.k role: employee · assigned record: INV-1001

Server-side authorization check Currently OFF — server trusts the ID in the URL and returns whatever record matches it.

VULN SECURE

OFF

id=1001 (yours) id=1002 id=1003 id=1004 id=1099 (admin payroll)

What the server is actually doing

This is the pseudocode driving the response above — flip the breaker to compare.

server/routes/invoice.js VULNERABLE

Why This Matters

Real-world pattern: Broken Access Control has topped the OWASP Top 10 since 2021, and IDOR (Insecure Direct Object Reference) is its most common form — an attacker doesn't need to hack anything, they just change a number in the URL or request body and see if the server actually checks who's asking. This is exactly how the 2019 First American Title breach exposed 885 million mortgage documents, and how countless bug bounty reports still get filed today: sequential IDs, predictable slugs, or an "id=" parameter that isn't scoped to the logged-in user's own records.

How to Detect & Protect

Enforce object-level authorization on every request — check that the logged-in user actually owns or is permitted to access the specific record ID, not just that they're logged in at all.
Avoid exposing raw, sequential internal IDs in URLs and APIs; prefer unguessable identifiers (UUIDs) or an indirect reference map tied to the session.
Add automated tests that log in as User A and attempt to read or modify User B's records by ID — this belongs in CI, not just manual QA.
Monitor access logs for abnormal ID-enumeration patterns — many sequential record IDs requested by one session in a short window.
Default to deny: authorization checks belong on the server for every object access, never inferred from client-side UI restrictions alone.