What other good solutions are there?
From the Area51 proposal
Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.Sign up to join this community
Summarizing atdre's link: OWASP ESAPI conveniently provides a mapping from a set of indirect references to the direct references, so convenient that you can even use a different mapping upon each request to your service.
Alternatives include container-managed security, Apache Shiro, and Spring Security, all of which are discussed in a StackOverflow question.
In the open-source OWASP ESAPI project, there is an example architecture with the correct controls in place to prevent IDORs. In that architecture is an Interface named AccessReferenceMap.
The AccessReferenceMap interface extends
java.io.Serializable and is used to map a set of internal direct object references to a set of indirect references that are safe to disclose publicly. It can be used to help protect database keys, filenames, and other types of direct object references. As a rule, developers should not expose their direct object references, as this enables attackers to attempt to manipulate them.