API3:2023 — Broken Object Property Level Authorization

Slide 9 · Two Patterns

Same root cause. Two attack directions.

Read too much. Accept too much. Both break at the property level.

Excessive Data Exposure (Read)

The API sends more than the user should see

Full object serialized and returned

Frontend filters what it displays — API doesn't

Attacker reads raw response: sees every field

No exploit needed — just an HTTP client

Mass Assignment (Write)

The API accepts more than the user should set

Framework binds all incoming JSON to the model

Developer protects some fields — but not all

Attacker adds extra fields to request body

Server writes them to database silently

Which is more dangerous?

Both. Excessive data exposure can leak password reset tokens that lead to account takeover. Mass assignment can make an attacker an admin in one request. Depending on what properties are exposed or accepted, either one can be catastrophic. OWASP merged them into one risk for exactly this reason.

← Back Excessive data exposure in detail →