Top 10 2010-A4-Insecure Direct Object References - OWASP

Top 10 2010-A4-Insecure Direct Object References - OWASP

Am I Vulnerable To 'Insecure Direct Object References'?

The best way to find out if an application is vulnerable to insecure direct object references is to verify that all object references have appropriate defenses. To achieve this, consider:

1. For direct references to restricted resources, the application needs to verify the user is authorized to access the exact resource they have requested.
2. If the reference is an indirect reference, the mapping to the direct reference must be limited to values authorized for the current user.

Code review of the application can quickly verify whether either approach is implemented safely. Testing is also effective for identifying direct object references and whether they are safe. Automated tools typically do not look for such flaws because they cannot recognize what requires protection or what is safe or unsafe.

Read full article from Top 10 2010-A4-Insecure Direct Object References - OWASP