
== Direct Object References

Direct Object References are when an application uses client-provided input to access data & objects.

=== Examples

Examples of Direct Object References using the GET method may look something like

`https://some.company.tld/dor?id=12345`

`https://some.company.tld/images?img=12345`

`https://some.company.tld/dor/12345`

=== Other Methods

POST, PUT, DELETE or other methods are also potentially susceptible and mainly only differ in the method and the potential payload.

== *Insecure* Direct Object References

These are considered insecure when the reference is not properly handled and allows for authorization bypasses or disclose private data that could be used to
perform operations or access data that the user should not be able to perform or access.
Let's say that as a user, you go to view your profile and the URL looks something like:

`https://some.company.tld/app/user/23398`

\... and you can view your profile there. What happens if you navigate to:

`https://some.company.tld/app/user/23399` ... or use another number at the end.  If you can manipulate the number (user id) and view another's profile, then the object reference is insecure.
This of course can be checked or expanded beyond GET methods to view data, but to also manipulate data.

=== More good reading
Before we go on to practice, here's some good reading on Insecure Direct Object References:

* link:++https://www.owasp.org/index.php/Testing_for_Insecure_Direct_Object_References_(OTG-AUTHZ-004)++[]
* https://www.owasp.org/index.php/Top_10-2017_A5-Broken_Access_Control
* https://cheatsheetseries.owasp.org/cheatsheets/Insecure_Direct_Object_Reference_Prevention_Cheat_Sheet.html
* https://www.owasp.org/index.php/Top_10_2013-A4-Insecure_Direct_Object_References
* http://cwe.mitre.org/data/definitions/639.html
