IDOR and how to stop it at the query layer

Authentication answers who are you. Authorisation answers what may you do. Two different questions — and an endpoint can answer the first perfectly while skipping the second entirely.

IDOR (Insecure Direct Object Reference) is the most common shape of that failure: the record identifier sits in the request, and the server uses it without asking whether the record belongs to the caller.

What makes IDOR different from other vulnerabilities, and why it has topped the Top 10 twice running: it has no syntactic signature. SQL injection has a quote you can grep for. A query missing its authorisation check looks exactly like one that has it — both are a single FirstOrDefaultAsync(x => x.Id == id). No linter finds it, no WAF blocks it, and automated scanners are blind to it because catching it requires understanding who ought to read what — that is, your business rules.

On impact: no escalation needed, no payload needed. A for loop over id is the whole table, and in your logs it looks like ordinary traffic from a signed-in user.