IDOR and broken object-level authorization (BOLA)
An insecure direct object reference (IDOR) exists when an application uses an identifier from the request, such as /invoice/1042, and returns the object without checking that it belongs to the current user. In APIs the same flaw is called broken object-level authorization (BOLA), and it is number one on the OWASP API Security Top 10.
How it happens
A user views their own record, notices a numeric or guessable ID in the URL or API call, and changes it. If the server only checks that the user is logged in, and not that they own that record, it returns someone else's data.
Because the requests look completely normal, IDOR is invisible to most network defences.
Why it matters
- Exposure of other customers' personal data, orders or documents.
- Unauthorised changes or deletions, if write endpoints are affected.
- Large-scale data scraping by iterating through IDs.
How to prevent it
- Check ownership or permission on every object access, on the server.
- Centralise authorization logic instead of repeating it in each handler.
- Prefer unguessable IDs (such as UUIDs) as a defence in depth, never as the only control.
- Write tests that access objects as a different user.
How Vooki Pro helps
- Includes checks for IDOR, BOLA and broken function-level authorization (BFLA) as part of its access-control and API security categories.
- Also tests horizontal and vertical privilege escalation, forced browsing and path normalisation bypasses.
- Scans authenticated areas using auth profiles, with automatic re-login when the session expires.
- Creates a ticket for each finding in Jira, GitHub, GitLab, Linear or Azure DevOps.
Frequently asked questions
Is IDOR the same as BOLA?
Yes, essentially. IDOR is the traditional web term; BOLA is the name used in the OWASP API Security Top 10 for the same missing ownership check.
Do UUIDs prevent IDOR?
Unguessable IDs make IDOR harder to exploit, but they are not a fix. The server must still check that the user is allowed to access each object.
Try Vooki Pro free for 7 days
Authorization flaws are the most common API vulnerability. Test yours with Vooki Pro. The trial unlocks every feature for 7 days, and scanning runs on your own machine.
Related: Server-side request forgery (SSRF) and cloud metadata attacks · Path traversal, local and remote file inclusion