Insecure direct object reference
A bug where changing an id in a request reaches someone else's record, because the app never checks who owns it.
Why 404 and not 403? A 403 would confirm that hike 17 exists and belongs to someone else. To a member, other people's hikes simply don't exist, so the honest answer is "not found". This bug class, reaching another person's record by changing a number in the URL, is called an insecure direct object reference, and it's one of the most common flaws found in real web apps. The fix is always the same: every lookup is scoped to the owner.
Try it now
The same checks run in the same order for every request a member makes.
Learn it properly
Project: a trail log web app · A multi-page app with a database, accounts, forms and tests. About 45 minutes.
Other terms from the same lesson
- app factory: A function that builds and returns a fresh web app, so each test or deployment gets its own copy with its own settings.
Never trained an AI?
Teach a small one to write, right in your browser. It takes about 20 seconds and needs no account.