idors-discovery-tool

What problem does it solve?

Checking resource-access logic to prevent unauthorized data access via URL manipulation. Trigger when the user asks "check my API auth", "can someone else see this order?", or "find IDOR vulnerabilities".

Core Features & Use Cases

• Identify Direct References: Look for endpoints accepting direct database IDs (e.g., /api/orders/{id}) to fetch user-specific data.
• Authorization Context: Verify if the controller/service actually checks if the currently authenticated user owns the requested resource before returning it.
• Abstraction Suggestion: Recommend using indirect references (e.g., non-guessable UUIDs) or scoping queries directly to the user (e.g., Auth::user()->orders()->findOrFail($id)).
• Output Format: Provide the remediated controller code demonstrating strict ownership checks.

Quick Start

Use IDOR discovery prompts to scan API endpoints and implement strict ownership checks.