{
  "id": 1612988,
  "title": "What a Single File Name Taught Me About IDOR (PortSwigger Lab)",
  "url": "https://urgent.news/2026/08/18/what-a-single-file-name-taught-me-about-idor-portswigger-lab",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-08-18T02:01:42.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/david_essien/what-a-single-file-name-taught-me-about-idor-portswigger-lab-42l2"
  },
  "original_language": "en",
  "account": "A single file name revealed an Insecure Direct Object Reference (IDOR) vulnerability in a PortSwigger Web Security Academy lab. The lab's setup involved a support chat feature that stored user transcripts directly on the server's file system and served them through static URLs. The goal was to find the password for a user named \"carlos\" hidden in his transcript and impersonate him.\n\nThe vulnerability was discovered when the lab file was named \"2.txt\". The lab demonstrated how a direct reference to a specific object (the file name) was exposed to the client, and the server trusted it without validation. To exploit the vulnerability, the lab requested \"1.txt\" instead of \"2.txt\", successfully accessing the password of user \"carlos\".\n\nThe key difference between IDOR and other types of access control failures lies in the server's reliance on the user-controlled value (file name) without verifying ownership. The lab emphasized two possible solutions to prevent such vulnerabilities: 1) stop letting the client name the resource and map the authenticated session to its own file server-side, or 2) use an unguessable identifier, such as a UUID, and still verify ownership server-side. The main takeaway was that the same principle of checking ownership server-side applies to IDOR, making it a more specific case of broken access control.",
  "summary": "My transcript downloaded as 2.txt . That was the entire vulnerability, sitting right there in a file name, and it took less time to exploit than it did to notice. This is a PortSwigger Web Security Academy lab, part of the access control section I've been working through. The setup is a support chat feature that stores each user's transcript directly on the server's file system and serves it back…",
  "key_points": [],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}