School · Module 2 · Lesson 3 of 4
Check ownership on the server (stop IDOR)
Hiding a button is not authorization. Every API route must check the session and the row.
Insecure Direct Object Reference (IDOR) happens when a route takes an id from the client and loads that row without checking that the signed-in user owns it.
In every Route Handler and Server Action: read the session, load the row, and compare owner_id (or equivalent) to the session user. Return 404 or 403 on mismatch.
CORS with credentials does not replace this check. An attacker can call your API from their own origin tools regardless of your UI.