django-access-review

Django access control & IDOR review

Contract

Inputs

Required: a Django or Django REST Framework codebase reachable as filesystem paths.

Optional: a specific component, endpoint, or model to scope the review. Without a scope, review the whole codebase and state which endpoints were and were not covered.

Procedure

Investigate rather than pattern-match. Every codebase enforces authorization differently; understand this implementation before judging it.

1. Map the authorization model. Before judging any endpoint, determine where permission checks live (decorators, middleware, base classes, DRF permission_classes, custom mixins), how queries are scoped (custom managers, get_queryset() overrides, middleware-set context), and what the ownership model is (single user, organization/tenant, hierarchical, role-based). Use grep/glob over *.py to find permission_classes, @login_required, @permission_required, base view classes, managers, get_queryset, and ownership fields (owner, user_id, organization, tenant). Do not proceed to findings until the model is understood. Done when: the authorization model and ownership rules are understood.

2. Map the attack surface. Identify models that hold user data and carry ownership fields or are addressed by ID in URLs, request bodies, or query params. For each, list the exposed operations: list, retrieve, create, update, delete, and custom actions. Done when: models and exposed operations are mapped.

3. Ask the core question per endpoint. For each endpoint handling user data: "If I am User A and I know the ID of User B's resource, can I access, modify, or delete it?" Trace the data flow: (a) where the resource ID enters (URL path, query param, request body); (b) where that ID fetches data (the ORM query or DB call); (c) what checks exist between entry and fetch: is the query scoped to the current user, is there an explicit ownership check, is there an object-level permission, does a base class/mixin/manager enforce access. If no check is visible, check parent classes, middleware, managers, and URL-level decorators before concluding a gap. Done when: each endpoint has an end-to-end authorization trace.