Insecure Direct Object Reference (IDOR)

Description

Detects when user-controlled input (from URL parameters, query strings, or request body) is used directly to access database records without verifying that the authenticated user has permission to access that specific resource. IDOR vulnerabilities allow attackers to access, modify, or delete resources belonging to other users by manipulating identifiers in requests.

What Shoulder detects

How to fix

Include userId in queries to verify resource ownership before access.

```javascript
const order = await Order.findOne({
  where: { id: req.params.id, userId: req.user.id }
});
```

Learn more: https://shoulder.dev/learn/javascript/cwe-639/idor

Applies to

References

Scan for this issue

Related rules