OWASP has some specific guidance on this while clarifying the need for access controls: https://cheatsheetseries.owasp.org/cheatsheets/Insecure_Direct_Object_Re

OWASP has some specific guidance on this while clarifying the need for access controls: https://cheatsheetseries.owasp.org/cheatsheets/Insecure_Direct_Object_Reference_Prevention_Cheat_Sheet.html#identifier-complexity https://cheatsheetseries.owasp.org/cheatsheets/Insecure_Dire...