Can Users See Each Other's Records? IDOR and Locker 14

2026-11-03

It's 8:15 on a Saturday, and you are standing in a hostel corridor holding a small metal key with a plastic fob. The fob says 14.

You are on a weekend away. The first one in months. You put your jacket in the locker, turn the key, and walk off toward breakfast.

Then, halfway down the stairs, a thought lands from nowhere.

What if the lockers only check that you have a key?

Not your key. Just a key. Any key, any locker.

You stop on the step. A man with a rucksack squeezes past you. And you realise you are no longer thinking about the hostel at all.

You are thinking about /orders/1043.

The URL you built in March

A small shop owner asked you for an order portal. Customers log in, they see their orders. You built it carefully. Login works. Tokens work. You checked the login three times.

But did you ever check what happens when a logged-in customer asks for order 1044 instead of 1043?

You can see the code in your head. A request arrives, the token is valid, the order is fetched by number, the order is returned. Nothing in that picture asks whose order it is.

Maybe it does. Maybe you wrote that line and forgot. Maybe you wrote it on three routes and not the fourth.

You honestly don't know. That's the part that sits in your stomach next to the croissant you haven't eaten yet.

The doubt nobody sees

Nobody has complained. No customer has written "I can see someone else's address." The shop owner thinks you are the person who handles that sort of thing. She sent you a thank-you emoji last month.

That emoji is now heavy.

You sit at the breakfast table with your phone and open the laptop in your head instead. You play the bad version: a stranger changes one number, sees a name and a street, tells the owner. The owner calls you. Your voice goes careful and quiet on the phone.

And you notice what the doubt is really costing. Not money, not yet. It's the weekend. You are in a pleasant place with a nice coffee and you are somewhere else.

You also notice you can't answer the question by worrying harder. You have been trying since the stairs.

The phone call you'd rather not make

So you think about what a professional does here.

Not a genius. Not someone who has memorised every way an API can go wrong. Just someone who, before handing a system to a client, sits down once with a list and asks the plain questions. Who is asking? What are they asking for? Does it belong to them?

You realise you have never had that list. You have had good habits and a vague feeling of having been careful. In the middle of a Saturday, a vague feeling is not very comforting.

It doesn't have to be like this.

The doubt isn't a sign you are bad at your job. It's a sign you care whether the person behind order 1044 stays private. That deserves something firmer than a feeling.

A different Monday

Picture the Monday after.

You open the project with a coffee. There's a short list next to it, one you didn't have to invent. You go through it the way you'd check your bag before leaving the house. Some things are already fine. One or two are not, and you find them on a quiet Monday morning rather than in an angry email.

You fix them. You tick them off. The question that followed you down the hostel stairs gets an actual answer.

Then, when the shop owner asks, "Is it all safe?", you don't say "I think so." You can say what you checked and what you found. Your voice stays level. That's a very different phone call.

And the next Saturday belongs to you again.

Back at the lockers

You finish breakfast. You walk back up the stairs and try your key on locker 14. It opens, of course. You check the lock on 15 out of pure curiosity. Your key does nothing there.

Someone made sure of that, long before you arrived. A small boring detail in a small metal door, and it's the reason nobody worries about their jacket.

That's all you want for your API: a boring detail, built in on purpose, that you can stop thinking about.

If that's you

If you recognised the stairs, the URL, the emoji that feels heavy, there is a calm way to put this down. The Launch Without the 2 a.m. Doubt – REST API Security Checklist Kit is a 58-item review kit for Node/Express and Python: a PDF, an XLSX tracker, curl tests, an auth-route scanner script and a client report template. It's made to turn "I hope it's fine" into "I looked." It comes with a 30-day money-back promise, so if it doesn't help, you get a full refund, no questions.

It won't replace a professional security audit for a system that needs one. It's a clear, organised first pass that is yours to run.

An illustrative story, written with AI assistance.