OWASP Broken Access Control
What is Broken Access Control (OWASP A01), and how do you prevent IDOR in a REST API?
Answers use simple, clear English.
Quick interview answer
Broken access control means users can act outside their permissions. IDOR is a common form: changing /orders/123 to /orders/124 to see another's data. Prevent by enforcing authorization on every request using the authenticated subject (never trust client-supplied user ids), centralized policies, and tests for horizontal/vertical privilege checks.
Detailed answer
Broken access control means users can act outside their permissions. IDOR is a common form: changing /orders/123 to /orders/124 to see another's data. Prevent by enforcing authorization on every request using the authenticated subject (never trust client-supplied user ids), centralized policies, and tests for horizontal/vertical privilege checks. Authentication ≠ authorization. Being logged in does not mean you may access every row.
Full explanation
Authentication ≠ authorization. Being logged in does not mean you may access every row.
Real example & use case
Multi-tenant SaaS where Tenant A must never read Tenant B's invoices even with a guessed UUID.
Pros & cons
Pros of server-side checks: real security. Cons: easy to miss on ad-hoc handlers — use filters/middleware and shared policy engines.