Insecure Direct Object Reference (IDOR)

// Node.js/Express - SECURE IDOR-protected endpoint

app.get('/api/users/:userId/profile', authenticateToken, async (req, res) => {
  try {
    const requestedUserId = parseInt(req.params.userId);
    const authenticatedUserId = req.user.id; // From JWT token
    
    // SECURE: Verify requested user matches authenticated user
    if (requestedUserId !== authenticatedUserId) {
      return res.status(403).json({ error: 'Access denied' });
    }
    
    // Now safe to query - can only access own profile
    const user = await db.users.findById(authenticatedUserId);
    
    if (!user) {
      return res.status(404).json({ error: 'User not found' });
    }

    res.json({
      id: user.id,
      username: user.username,
      email: user.email,
      role: user.role
      // Don't expose api_key in API responses
    });
  } catch (err) {
    res.status(500).json({ error: 'Server error' });
  }
});

app.get('/api/documents/:docId/download', authenticateToken, async (req, res) => {
  try {
    const docId = req.params.docId;
    const userId = req.user.id; // From authenticated token
    
    // SECURE: Scope query by BOTH document ID and owner
    const document = await db.documents.findOne({
      id: docId,
      owner_id: userId  // Only returns if user owns this document
    });
    
    if (!document) {
      // Return 404 for both missing and unauthorized (don't leak existence)
      return res.status(404).json({ error: 'Document not found' });
    }

    // Only sends files that belong to the authenticated user
    res.download(document.filepath, document.filename);
  } catch (err) {
    res.status(500).json({ error: 'Server error' });
  }
});

// ALTERNATIVE: Use opaque tokens instead of predictable IDs
app.get('/api/documents/download/:token', authenticateToken, async (req, res) => {
  // Token is a signed, time-limited URL token (e.g., JWT with docId + expiry)
  const decoded = verifyDownloadToken(req.params.token);
  
  if (!decoded || decoded.userId !== req.user.id) {
    return res.status(403).json({ error: 'Invalid token' });
  }
  
  const document = await db.documents.findById(decoded.docId);
  res.download(document.filepath, document.filename);
});