Object Reference

The records API exposes an assigned numeric object. Test whether changing its location also changes what the server authorizes.

Objective

• Distinguish object selection from object-level authorization.
• Support an IDOR finding with owner and response evidence.

Before you begin

Open /challenge/medium/objects and inspect only the nearby training records suggested by the challenge.

Concepts

An identifier locates an object; it does not prove the requester may access it. Authorization must be evaluated for every object request.

An object identifier locates a record; it does not prove permission to use it. The server must check the authenticated user's relationship to the specific object and requested action. Apply the check to every access path, including downloads and APIs. Unpredictable identifiers can reduce guessing but do not replace authorization.

Suggested tools

• Browser or JSON viewer: Makes record IDs and owners easy to compare.

Tool practice

Rehearse the worked tool exercise before using challenge data.

Practice extracting an ID together with its nested value in the JSON exercise. For the game, make a two-row table of request path, returned ID, owner, and relevant content. A 404 supplies no second object to compare.

Investigation

Observe

Record the assigned object's ID and owner, then note which URL segment selects it.

Form a hypothesis

Will a nearby identifier return a record with a different owner?

Test carefully

Change only the final numeric segment and compare the two responses.

Progressive hints

Troubleshooting and reset

Keep the /api/medium/records/ prefix unchanged. A missing record is not a solution and does not require reset.