Insecure Direct Object Reference in Django with Mongodb

To prevent IDOR when using Django with MongoDB, enforce per-request ownership or role-based checks before returning or modifying a document. Store the mapping between Django user identities and MongoDB document ownership explicitly (e.g., a user_id field in each document) and include that field in every query.

Below is a secure pattern that binds the query to the authenticated user’s ID, using PyMongo safely within a Django view:

from django.http import JsonResponse, HttpResponseForbidden
from django.contrib.auth.decorators import login_required
from pymongo import MongoClient

@login_required
def get_profile_secure(request, profile_id):
    client = MongoClient('mongodb://localhost:27017/')
    db = client['mydb']
    # Ensure the profile belongs to the requesting user
    profile = db.profiles.find_one({'_id': profile_id, 'user_id': request.user.id})
    if profile is None:
        return HttpResponseForbidden({'error': 'Access denied or not found'})
    # Explicitly exclude sensitive fields that should not be returned
    profile.pop('password_hash', None)
    profile.pop('tokens', None)
    return JsonResponse({'profile': profile})

For updates, use an update operation that includes the ownership filter to ensure the document both exists and is owned by the user:

@login_required
def update_profile(request, profile_id):
    client = MongoClient('mongodb://localhost:27017/')
    db = client['mydb']
    update_data = {'$set': request.body_as_json}
    result = db.profiles.update_one(
        {'_id': profile_id, 'user_id': request.user.id},
        update_data
    )
    if result.matched_count == 0:
        return HttpResponseForbidden({'error': 'Update not permitted or document not found'})
    return JsonResponse({'status': 'updated'})

When using ObjectIds, ensure they are validated before inclusion in queries to avoid injection-like parsing errors. You can also centralize access checks in a service layer or repository function to avoid repeating checks across views:

def get_document_or_404(collection, doc_id, user_id):
    doc = collection.find_one({'_id': doc_id, 'user_id': user_id})
    if doc is None:
        raise Http404('Document not found or access denied')
    return doc

In multi-tenant scenarios, include a tenant_id field in both the user model and documents, and filter by tenant_id in every query. For read-heavy endpoints, consider projection to limit returned fields and reduce Data Exposure, and validate that indexes support the ownership filter for performance.

Using the middleBrick CLI, you can scan endpoints like this to detect IDOR and related issues:

middlebrick scan https://api.example.com/profiles/<profile_id>

Within the dashboard, you can track these findings over time; with the Pro plan you can enable continuous monitoring so that any regression in permissions is flagged early. The GitHub Action can fail a build if a scan detects IDOR patterns, helping prevent insecure patterns from reaching production.