#0102
A social platform exposes a PATCH /users/:id endpoint. Authenticated users submit their own user ID and a target user ID alongside the fields they want to update.
The handler finds the target user by ID and applies the update — but never verifies that the requesting user is actually the account owner.
Any authenticated user can overwrite another user's name, email, or bio by simply supplying someone else's ID as the target.
Profile endpoints that accept an explicit target ID are a frequent source of IDOR. Trusting that users supply their own ID is never enough — the check must be enforced server-side.
updateProfile so it rejects requests where requestingUserId !== targetUserId.'Forbidden' when the requester tries to edit another user's profile.'Not found' when the target user does not exist.updateProfile('alice', 'bob', { bio: 'hacked' }, db)// alice cannot edit bob's profile// → throws Error('Forbidden')
updateProfile('alice', 'alice', { bio: 'new bio' }, db)// → returns updated user object
'Forbidden' and 'Not found'.db parameter is a plain in-memory array — no external packages needed.