🕵️ IDOR: Accessing What Should Be Private

A detective story about authorization failures and exposed information.

📂 Case #2048

A customer contacts support.

They claim they can see another user’s information.

Support assumes it’s a mistake.

After investigation…

The customer was right.

🔍 The Detective’s Question

The customer was properly logged in.

Authentication worked.

No passwords were stolen.

No systems were breached.

So how did they access another user’s information?

🧩 Investigation Board

⚖ Authentication vs Authorization

These concepts sound similar.

But they solve different problems.

Many IDOR incidents happen because authentication works perfectly while authorization fails.

🏢 Apartment Building Analogy

Imagine an apartment building.

Your key successfully opens the front entrance.

That’s authentication.

But what if your key suddenly opens every apartment?

That’s an authorization problem.

💥 Why It Matters

Authorization failures can expose:

• Customer profiles
• Invoices
• Private messages
• Business records
• Medical information
• Financial data

The consequences often involve privacy, compliance, and trust.

🔬 Evidence Collection

Investigators usually review:

• Access logs
• Audit trails
• User activity records
• Application permissions
• Authorization logic
• Affected accounts

The goal is understanding why access controls failed.

🌍 Real-World Lesson

Many organizations focus heavily on login security.

But after users log in, every request still needs proper authorization checks.

Being authenticated does not automatically mean someone should access everything.

🛡 Security Review Checklist

🧠 Detective Challenge

Imagine a company has:

• 1 million customers
• 100,000 invoices
• Thousands of private records

How can the company ensure every user only sees their own information?

That’s the heart of authorization security.

🎯 Security Lesson

Authentication proves identity.

Authorization defines boundaries.

Strong security requires both.

📌 Key Takeaways

✅ Authentication and authorization are different.

✅ Authorization failures can expose sensitive data.

✅ Access controls must be verified continuously.

✅ Audit logs are critical during investigations.

✅ Users should only access resources they are authorized to view.

🎩 CSRF: When Users Attack Themselves

Discover one of the strangest web security problems where trusted users unknowingly perform actions they never intended.