A logged-in customer changes `/invoices/41` to `/invoices/42` in the address bar and sees someone else's invoice. What is the missing defence?

Tip: press 1-4 to answer, Enter to continue. Finish the quiz to bank your XP.

A logged-in customer changes /invoices/41 to /invoices/42 in the address bar and sees someone else's invoice. What is the missing defence?