A mental model for IDOR/BAC that's been more useful to me than any checklist
Most of the IDOR advice out there boils down to "change the number in the URL." That catches maybe the easiest 10% of what's actually there.
The question that's actually moved the needle for me: "Who is supposed to reach this resource, and who can actually reach it?" Every access control bug — IDOR, broken function-level auth, privilege escalation — is a gap between those two answers. The ID or cookie or header is just the mechanism the gap happens to travel through.
A few patterns I keep running into that don't get talked about much:
- Multi-step forms that check auth on step 1 and never re-verify on steps 2-3
- Bulk/batch endpoints that check ownership on the first ID in an array and stop there
- API version drift — /v1/ enforces the check, /v2/ quietly doesn't because the check lived in the route handler, not a shared layer
Also something that took me a while to internalize: the exploit request rarely confirms itself. It's often a bare 302 with an empty body, not a helpful "success, you're admin now!" message. The signal is usually in what you sent, not what came back — and often only shows up when you compare two consecutive requests of the same shape.
Curious what patterns other people here run into most often that aren't in the "standard" IDOR writeups.