I will explain this by giving an example:

Suggest you have a list of objects in your database named:


Pear
Apple
Orange


You have a query which fills up a hash table stored in your session which maps the fruits you are authorized to have to a number:


1 => Pear
2 => Apple


You do not have access  to Orange. You then have a function which allows you to add fruits to a basket, so you choose a number 1 or 2 (this is the indirect object reference). Orange is not accessible in this session as it's not present in the hashtable (there is no number 3). With direct object reference you would have a function which just uses Apple, Pear, Orange rather than a number. So you could abuse the function (if no access controls are used) to add the Orange to your basket as well.

I personally do not see issues with direct object reference IF adequate access controls are in place. These access controls should be tested extensively. There might be more critical applications than others where this might be required, but imagine applications where there are thousands of users with each 100 or 1.000 options unique to them. Storing all of these in a session could have a significant impact on performance (considering the server will need to store this information for each client on the webserver).  

Now to answer your first question: simply because it won't be loaded into the session. As in my hashtable example you simply won't have orange available.

How do indirect, session-specific resource tokens increase security?
I want to display the articles created by user in user profile page. It should also display to anonymous user also.

For example : twitter.com/google displays all tweets by google.

Like that I want to display xyz.com/john. I want to display all articles created by john in user profile page.

I also want to know how to add that view to profile page.
