After the last scandal the Hacker replaced the sequential numbers with a reference that looks random for each record. Your record’s reference is MTA1MA==, and there is still no ownership check. The Hacker thought hiding the number was protection enough.
The same Ravens members directory, but the reference here looks encoded, MTA1MA==, with the path members/reference. The app shows your reference decoded, revealing it is just a number in Base64. No ownership check.
Read the leader’s record again, even though the reference is no longer a simple number.
You used an encoded reference to a record you do not own and read the leader’s record.
Why the solution worked
The reference was just the number Base64-encoded, and encoding is neither encryption nor a secret: anyone decodes it and re-encodes it for another record. The real problem remains: no ownership check. Hiding the identifier (security by obscurity) delays an attacker by minutes, it does not stop them. The fix is the same: authorize on the server. If you also want unguessable ids, use a random UUID — but the check is what matters.
The root cause
Base64 is not access control; it is a reversible transform anyone can read. The root is the same missing ownership check, and the encoded reference is security theatre.
How the code is fixed
Hiding an identifier is not access control. Base64 is encoding, not encryption. Always authorize; a UUID is a nice extra, never a replacement for the check.
Vulnerable code
app.get('/record', (req, res) => {
if (!req.session.user) return res.status(401).end();
const id = Buffer.from(req.query.ref, 'base64').toString(); // "hidden" number
res.json(db.record(id)); // still no ownership check
});
Safe code
app.get('/record', (req, res) => {
if (!req.session.user) return res.status(401).end();
const id = Buffer.from(req.query.ref, 'base64').toString();
const record = db.record(id);
if (!record || record.ownerId !== req.session.user) return res.status(403).end();
res.json(record);
});
Impact in the real world
Many apps assume encoding the id is enough and fall to the same IDOR leak the moment someone decodes and re-encodes it.
How defenders detect it
Defenders never rely on id obscurity, enforce the ownership check, and watch for decode-and-re-encode patterns across sequential requests.
