Slide 15 of 28
Part 3 · Attack ScenariosSlide 15
Slide 15 · Scenario 2
The user who deleted someone else’s content.
OWASP Scenario #2 — HTTP verb manipulation on a shared resource endpoint.
📄 OWASP API Security Top 10 · 2023 · API5 · Scenario 2
SETUP
A content platform’s post endpoint.

A content platform’s post endpoint handles reads and writes:

GET /api/v1/posts/{id} — returns a post, available to any user

PUT /api/v1/posts/{id} — updates the post, restricted to the post’s author

DELETE /api/v1/posts/{id} — deletes the post, intended for admins only

The developer added an ownership check for PUT (only the author can update their post). DELETE was added later and has no role check — it was assumed to be “internal.”

The exploit: A user who wants to remove a competitor’s post sends DELETE /api/v1/posts/5523 with their own (non-admin) auth token. The API validates the token (valid), routes to the delete handler, finds no role check or ownership check for DELETE, and removes the post. Any user can now delete any post on the platform — including content they never created.
The asymmetry of HTTP method protection

It is extremely common to add ownership checks for PUT but forget them for DELETE. The consequences of an unauthorized DELETE are usually worse — deletion may be irreversible. The methods that cause the most damage are often the least protected.

← Back Scenario 3 →