Secure Your Node.js Web Application

Don’t Use Insecure Direct Object References

Applications often use names, identifiers, or keys of objects when generating web pages. Sometimes they forget to validate the user’s access to a specific object. This becomes a problem after validation when an authenticated user can still access objects that aren’t supposed to be accessible. And they can do it by knowing or guessing the keys of other objects.

This is similar to the missing path validation issues we discussed earlier, except this applies to dynamically generated pages. Let’s look at an in-memory database, db, which stores the user data. Users can log in and see the data via the settings page on /settings/:id:

chp-9-access-control/idor.js

// Middleware to validate that users are authenticated ...