# Authorization Bypass Through User-Controlled Key (CWE-639)

The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

**Stack:** Python

- Prevalence: 高 频繁被利用
- Impact: 关键 1 条严重级别为关键的规则
- Prevention: 已记录 8 个修复示例

**OWASP:** Broken Access Control (A01:2021-Broken Access Control) - #1

## Description

Retrieval of a user record usually occurs in the system based on some key value. When a value that is directly specified by the user is used to look up that record, the key value can be modified to access records belonging to other users.

## Prevention

基于 2 条 Shoulder 检测规则的 Authorization Bypass via User Key 预防策略。

### Python

Include the authenticated user as a filter condition in all ORM queries that use user-supplied IDs

Verify resource ownership before returning data accessed by user-supplied identifiers

## Warning Signs

- [HIGH] database object access using user-provided IDs without ownership
verification
- [MEDIUM] route parameters flowing to generic data access without visible
ownership verification

## Consequences

- 读取应用程序数据
- 修改应用程序数据
- 获取权限

## Mitigations

- 使用间接引用(映射)而非直接的数据库键
- 验证当前用户具备访问所请求资源的权限
- 对每个请求实施适当的访问控制检查

## Detection

- Total rules: 8
- Critical: 1
- Languages: go, javascript, typescript, python

## Rules by Language

### Python (2 rules)

- **Insecure Direct Object Reference (IDOR)** [HIGH]: Detects database object access using user-provided IDs without ownership
verification.
  - Remediation: Filter queries by both object ID and current user.

```python
document = Document.objects.get(id=doc_id, owner=request.user)
```

Learn more: https://shoulder.dev/learn/python/cwe-639/idor
- **Potential IDOR - Generic Data Access** [MEDIUM]: Detects route parameters flowing to generic data access without visible
ownership verification.
  - Remediation: Verify ownership before returning data.

```python
if order['user_id'] != current_user.id:
    return jsonify({'error': 'Forbidden'}), 403
```

Learn more: https://shoulder.dev/learn/python/cwe-639/idor-generic