---
description: Insecure Direct Object References.
---

# IDOR

Occurs when a web application allows a user to access data or resources that they should not view or modify, simply by manipulating object identifiers (such as numeric IDs, keys, or other unique identifiers) within the URL or request parameters.

**Steps**:

* Check parameters&#x20;
* Check javascript&#x20;
* Check API calls

