What it is
IDOR (a form of broken object-level authorization) occurs when an application exposes a direct reference to an object — a numeric id, UUID, or filename — and authorises the action based on that reference alone, without checking that the current user owns it.
How to test for it
Capture a request that references an object you own, then change the identifier to one belonging to another account and observe whether access is granted. Test every verb (read, update, delete) and look for predictable or leaked identifiers.
How to prevent it
Enforce object-level authorization on the server for every request — verify the authenticated user is allowed to act on the specific object. Use unguessable identifiers as defense in depth, never as the only control.