django-access-review

To review Django applications for access control and IDOR vulnerabilities, you analyze Django views, DRF viewsets, and ORM queries to verify proper authorization checks are enforced for user data access.

An IDOR vulnerability in Django ORM queries occurs when object references are exposed directly, allowing users to manipulate parameters to access unauthorized data because proper authorization checks are missing on retrieved objects.

Yes, this skill can analyze DRF viewsets for missing authorization checks. It evaluates Python and Django code within your views and viewsets to ensure access controls are properly enforced before returning data.

The best way to prevent unauthorized data access in Django web applications is to audit your authorization logic systematically, ensuring ORM queries and viewsets restrict data access strictly to the authenticated user's own records.

You need foundational knowledge of Django authorization mechanisms and Python code analysis to effectively audit Django authorization logic, as the review requires interpreting ORM queries and access control implementations.