API Testing · Senior · Question 14 of 75
What does "broken object property level authorization" cover?
- 1Reading or writing fields a user shouldn't, like
isAdmin - 2Objects that are stored with the wrong property types
- 3Properties that are missing from the API documentation
Show the answer
Correct answer: Reading or writing fields a user shouldn't, like isAdmin
Explanation
It merges excessive data exposure and mass assignment: responses leaking fields and requests changing protected ones.