API Design · Middle · Question 32 of 75

What is Broken Object Property Level Authorization (OWASP API3:2023)?

✓Correct answer: Exposing or allowing changes to object properties the user shouldn't see or modify, e.g. returning passwordHash or accepting role in an update
2Slow database queries
3Missing pagination

Explanation

Use explicit response models and input allow-lists instead of returning or binding whole objects.

Further reading

OWASP API Security Top 10 (2023) ↗

Test yourself

Take the API Design · Middle quiz: questions and options are shuffled, and you get a review of your mistakes at the end.