Insecure Direct Object Reference (IDOR)

HIGH CWE-639 · Authorization Bypass Through User-Controlled Key

Description

Detects IDOR vulnerabilities where user-supplied IDs access resources without authorization checks.

What Shoulder detects

User-supplied ID used to access resource without authorization check

How to fix

Validate ownership before accessing resources.

```go
if requestedID != currentUserID && !isAdmin(currentUserID) {
    return errors.New("unauthorized")
}
```

Learn more: https://shoulder.dev/learn/go/cwe-639/idor

Applies to

Languages

🐹 Go

References

Documentation ↗ OWASP ↗ Learn about CWE-639

Scan for this issue

Detect with Shoulder CLI

npx @shoulderdev/cli trust --rule=go-idor .