API3:2023 — Broken Object Property Level Authorization

Slide 2 · The Word

Broken Object Property Level Authorization.

Not the wrong object — the wrong properties of the right object.

Object Properties

Every data object an API works with has properties — the individual fields that describe it.

A user object has properties like: id, name, email, role, isAdmin, passwordHash, balance.

Some of those properties are fine for the user to read or change. Others absolutely are not.

Properties the user should control

name — update your display name

email — update your email address

bio — edit your profile bio

profilePhoto — change your avatar

Properties they should never touch

isAdmin — whether you're an administrator

role — your permission level

balance — your account balance

verified — whether your account is verified

passwordHash — your stored password hash

Two directions, one risk

Read side (Excessive Data Exposure): The API returns sensitive properties the user shouldn't be able to see — password hashes, admin flags, other users' private data.

Write side (Mass Assignment): The API accepts and applies sensitive properties the user shouldn't be able to set — role, isAdmin, price, balance.

← Back See the official definition →