Lesson 2.3: Object properties: mass assignment and oversharing
Web 101 covered object-level access: may this user see order 1042? APIs also need property-level access: which fields of an object may a user read, and which may they change? Frameworks make it easy to return a whole database row and to copy a whole request body into it. The result is API3:2023 in the OWASP API Security Top 10, Broken Object Property Level Authorization: responses that leak password hashes and internal notes, and requests that quietly set role to admin. In the lab you see both on Northwind's API, find the two accounts that promoted themselves, review a fix based on allow-lists, deploy it and prove it.
17 min
You will learn to
- Explain property-level authorisation (API3:2023)
- Recognise excessive data exposure in responses
- Recognise mass assignment in code
- Use allow-lists for readable and writable fields
- Find abuse in an audit log
Key terms
- OWASP API Security Top 10 (2023)
- The most critical API risks; API1 is BOLA, API3 is broken object property level authorisation.
- Mass assignment
- Binding all request fields to an object, including ones the client must not set.
- Excessive data exposure
- Returning more fields than the client needs and relying on it to hide them.
- Allow-list (of fields)
- An explicit list of fields that may be read or written; everything else is refused.
- DTO / serializer
- A separate object or schema that defines exactly what goes in and out of the API.
← The OWASP Top 10, and what attacks look like in a log · All lessons · Stale and risky accounts →