Insecure Direct Object Reference Prevention Cheat Sheet. The most common example of IDOR is referenced in element A4 of the OWASP Top 10 in the 2013 edition. An attacker can build a collection of valid ID from EMP-00000 to EMP-99999. The proposal use a hash to replace the direct identifier. This hash is salted with a value defined at application level in order support topology in which the application is deployed in multi-instances mode (case for production).”]