From 9739d6656de51af3f2c40bbbf7f7ae85eeae4b72 Mon Sep 17 00:00:00 2001 From: unknown Date: Tue, 4 Aug 2026 14:57:28 -0700 Subject: [PATCH] Clarify that GUIDs are not an authorization control --- editions/2023/en/0xa1-broken-object-level-authorization.md | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/editions/2023/en/0xa1-broken-object-level-authorization.md b/editions/2023/en/0xa1-broken-object-level-authorization.md index be629d9c8..708910078 100644 --- a/editions/2023/en/0xa1-broken-object-level-authorization.md +++ b/editions/2023/en/0xa1-broken-object-level-authorization.md @@ -89,6 +89,12 @@ checks, a user may be able to delete another user's document. * Write tests to evaluate the vulnerability of the authorization mechanism. Do not deploy changes that make the tests fail. + **Note** + +* Using GUIDs/UUIDs instead of predictable identifiers helps mitigate object enumeration attacks. However, once a valid identifier is disclosed—whether through another endpoint, excessive data exposure, logging, or another vulnerability—it should be treated as public information. + +* Authorization decisions must never rely on the secrecy or unpredictability of object identifiers. Every request must independently verify that the authenticated user is authorized to access the requested object. + ## References ### OWASP