Broken Access Control & IDOR

Horizontal and vertical privilege escalation, and server-side checks.

Video tutorialTrack course · freeCodeCamp

Ethical Hacking & Web Security Full Course

Speed

0.75x1x1.25x1.5x2x

Skip intro Next lesson

Watch 00:00 · 2 checkpoints Watch on YouTube More on this topic

Transcript & captions .txt

10/10

1. 00:00Broken Access Control & IDOR. Horizontal and vertical privilege escalation, and server-side checks.
2. 00:05Broken access control is the number one item on the OWASP Top 10.
3. 00:10IDOR (Insecure Direct Object Reference) is its most common form: change an id in a request and read someone else's data.
4. 00:18IDOR (js): GET /api/invoices/1042 -> your invoice…
5. 00:23Horizontal escalation: reach another user's data at the same level.
6. 00:28Vertical escalation: reach admin-only functionality.
7. 00:33Hidden admin routes are not access control - enforce on the server.
8. 00:38Check authorisation on every request, not just on page load.
9. 00:43Deny by default; allow explicitly per role and per resource owner.
10. 00:48Note: In a database with row level security, write policies that scope rows to the authenticated user, and never decide privilege from client-supplied values.

Broken access control is the number one item on the OWASP Top 10. IDOR (Insecure Direct Object Reference) is its most common form: change an id in a request and read someone else's data.

GET /api/invoices/1042   -> your invoice
GET /api/invoices/1041   -> someone else's invoice

// FIX: scope every query to the caller
select().eq('id', id).eq('owner_id', session.userId);

• Horizontal escalation: reach another user's data at the same level.
• Vertical escalation: reach admin-only functionality.
• Hidden admin routes are not access control - enforce on the server.
• Check authorisation on every request, not just on page load.
• Deny by default; allow explicitly per role and per resource owner.