Understanding and Preventing Insecure Direct Object Reference (IDOR) Vulnerabilities in Web Applications

Common HTTP Status Codes and Their Meanings.

1. 200 OK 
   
   Meaning: The request was successful, and the server returned the expected response.
   Example: A successful GET request to retrieve data. 
   
   
           Live API Example: 
• GET https://jsonplaceholder.typicode.com/posts/1 
• This returns a specific post from a sample JSON API
  
  
  
2. 201 Created
   
   Meaning: The request has been fulfilled, and a new resource was created.
   Example: A POST request that creates a new resource on the server 
   
   
           Live API Example: 
• POST https://jsonplaceholder.typicode.com/posts  
• Sending JSON data in the body to create a new post.
  
  
  
3. 204 No Content
   
   Meaning: The request was successful, but there is no content to return
   Example: A DELETE request where the resource was deleted successfully.
   
   
           Live API Example: 
• DELETE https://jsonplaceholder.typicode.com/posts/1   
• This deletes a specific post and returns no content.
  
  
  
4. 400 Bad Request 
   
   Meaning: The server could not understand the request due to invalid syntax.
   Example: A malformed request that the server can’t process. 
   
   
           Live API Example: 
• GET https://jsonplaceholder.typicode.com/posts/abc   
• This returns a specific post from a sample JSON API
  
  
  
5. 401 Unauthorized 
   
   Meaning: Authentication is required, and the user is not authenticated.
   Example: Accessing a protected resource without valid credentials. 
   
   
           Live API Example: 
• GET https://reqres.in/api/secure-endpoint   
• Accessing a secure endpoint without proper authentication.
  
  
  
6. 403 Forbidden
   
   Meaning: The request is valid, but the server refuses to authorize it.
   Example: Trying to access a restricted resource. 
   
   
           Live API Example: 
• GET https://jsonplaceholder.typicode.com/admin  
• Accessing a restricted resource that you don’t have permission to access.
  
  
  
7. 404 Not Found
   
   Meaning: The server cannot find the requested resource.
   Example: A GET request to a non-existent endpoint or resource.
   
   
           Live API Example: 
• GET https://jsonplaceholder.typicode.com/posts/12345  
• Requesting a post that does not exist.
  
  
8. 500 Internal Server Error
   
   Meaning:  The server encountered an unexpected condition that prevented it from fulfilling the                       request.                        
   Example: A server misconfiguration or issue causes the error.
   
   
           Live API Example: 
• GET https://httpstat.us/500  
• This returns a 500 error to simulate a server issue.
  
  
9. 502 Bad Gateway
   
   Meaning: The server, while acting as a gateway or proxy, received an invalid response from the                    upstream server.                                 
   Example: A server in the middle cannot process the request properly.
   
   
           Live API Example: 
• GET https://httpstat.us/502  
• This returns a 502 error to simulate a bad gateway issue.
  
  
10. 503 Service Unavailable
    
    Meaning: The server is temporarily unable to handle the request due to maintenance or overload.
    Example: A server is under maintenance or experiencing a high load.
    
    
           Live API Example: 
• GET https://httpstat.us/503
• This returns a 503 error to simulate a service unavailability.