codejump
MediumJavaScriptTypeScript

IDOR — Verify Ownership Before Returning a Resource

TypeScriptSecurityAccess Control

The order-lookup handler below returns whatever order matches the requested ID — without checking who's asking.

The bug: any logged-in user can view *any* order by simply changing the ID in the URL (/orders/1, /orders/2, ...) — a textbook Insecure Direct Object Reference.

Your task: fix solve(currentUserId, order) so it returns the order only when order.ownerId matches currentUserId — null otherwise.

Sample tests

Test #1Owner viewing their own order
Input: ["u1",{"id":"o1","total":100,"ownerId":"u1"}]
Output: {"id":"o1","total":100,"ownerId":"u1"}
Test #2Different user tries to view order by changing the ID
Input: ["u2",{"id":"o1","total":100,"ownerId":"u1"}]
Output: null
Test #3A different owner viewing their own order still works
Input: ["u2",{"id":"o2","total":50,"ownerId":"u2"}]
Output: {"id":"o2","total":50,"ownerId":"u2"}
← All challenges