An interactive explainer

He was logged in. As himself. That was the whole attack.

Logging in proves who you are. It does not decide what you may touch. Most applications check the first once, at the door, and then trust whatever id arrives in the request. So a real, paying, logged-in customer changes one number in the URL and reads someone else's data. Every request is authenticated. Every log line says 200.

Authorization · IDOR · Access control

Security · Beginner · 8 min · Why changing one number in the URL still works — an interactive explainer on ViLearn, with a simulation and a knowledge check. All explainers.

Related: How a service decides who gets in · How two strangers get a secret past everyone in the room · How the internet finds google.com