API3:2023 — Broken Object Property Level Authorization

Slide 18 · Prevention Overview

Seven ways to fix broken property-level authorization.

Four for the write side. Three for the read side. All mandatory.

📝

MIT 01 — Allowlist Writable Properties

Explicitly declare which fields each endpoint is permitted to accept and write. Everything else is rejected.

🚫

MIT 02 — Never Bind All Input to the Model

Disable framework auto-binding or configure it with a strict field allowlist. Never use bind-all in production.

📦

MIT 03 — Use DTOs / Separate Input & Output Schemas

Define separate objects for what you accept (input) vs. what you return (output). Never use the database model directly in the API layer.

🔒

MIT 04 — Server-Side Only Properties

Properties like isAdmin, role, verified, blocked must only be settable by server-side logic — never by client input.

📊

MIT 05 — Minimize Returned Data

Return only the fields the client actually needs for this operation. Default to returning less, not more.

🧾

MIT 06 — Schema-Based Response Validation

Define and validate the exact shape of every API response. Catch accidental property exposure before it reaches the client.

🔍

MIT 07 — Enforce at the API Layer, Not the UI

Property filtering must happen in the API response, not the frontend render. The UI can be bypassed. The API cannot.