Question

Like XSS and open redirects, insecure direct object references ( IDORs) are a type of bug present in almost every web application. They happen when the application grants direct access to a resource based on the user’s request, without validation.

与 XSS 和开放式重定向一样，不安全的直接对象引用（IDOR）是几乎每个 Web 应用程序都存在的类型错误。当应用程序在不进行验证的情况下基于用户请求直接访问资源时，就会发生这种情况。

In this chapter, we’ll explore how these work. Then we’ll dive into how applications prevent IDORs, and how you can bypass those common protection mechanisms.

在本章中，我们将探讨它们的工作原理。然后，我们将深入研究应用程序如何防止 IDOR，并介绍如何绕过这些常见的保护机制。