Insecure Direct Object Reference

A direct object reference occurs when an Application exposes a direct reference to an internal object without proper authorization.

This class of vulnerability results in an insecure direct, which may result in access to sensitive data and authorization bypass.

There are multiple ways to prevent Indirect Object Reference vulnerabilities:

Use Indirect Object References: Instead of exposing direct references to internal objects (such as database IDs), use indirect references or tokens that are mapped to the objects on the server-side. This prevents users from tampering with identifiers directly.
Implement Access Controls: Apply access controls at both the frontend and backend to enforce restrictions on what data users can access. This includes role-based access control (RBAC), attribute-based access control (ABAC), or any other relevant access control mechanism.
Use Cryptographically-Secure Object References: If possible, use cryptographic techniques such as HMAC or UUID to generate unpredictable secure object references or tokens.