The IDOR Trap
#security-critical — any user can download any invoice
Bug bounty: user_A changed /api/invoices/inv_101 to inv_102 and got user_B's financial data with 200 OK. JWT middleware authenticates — but never checks ownership.
The trap: AuthN without AuthZ — valid token ≠ access to every object.
Your task
Fix `getInvoiceHandler()` in `idor_server.js`: verify `invoice.owner_id === user.user_id` before returning data. Return 403 when the user does not own the resource.
Book: protect routes with JWT · Prod: #1 OWASP API risk is BOLA/IDOR.
Skills you'll prove
Interview Tip
When asked how you secure REST APIs or what IDOR/BOLA is, say: "The most common API vulnerability is confusing Authentication with Authorization. A valid JWT proves who the user is, but it doesn't grant them access to every resource. I prevent IDORs by implementing strict Object-Level Authorization. Before returning any resource, I verify that the owner_id on the object matches the user_id in the JWT context. I also use UUIDs instead of sequential IDs to prevent enumeration attacks."