What API3:2023 Broken Object Property Level Authorization requires
OWASP API Security Top 10 (2023) API3:2023 Broken Object Property Level Authorization. When allowing a user to access an object using an API endpoint, it is important to validate that the user has access to the specific object properties they are trying to access. An API endpoint is vulnerable if: * The API endpoint exposes properties of an object that are considered sensitive and should not be read by the user. (previously named: "[Excessive Data Exposure][1]") * The API endpoint allows a user to change, add/or delete the value of a sensitive object's property which the user should not be able to access (previously named: "[Mass Assignment][2]") This category sits within the OWASP API Security Top 10 (2023 edition), the canonical industry list of the ten most critical API security risks. Organizations implementing API services should treat each of the ten categories as both a design constraint and a continuous-monitoring obligation, with policies, automated testing, and incident response procedures defined per category.
Pillar: Cybersecurity · Authority: OWASP Foundation (Open Worldwide Application Security Project) · Version: 1.0.0 · Last updated:
Primary source: https://owasp.org/API-Security/editions/2023/en/0xa3-broken-object-property-level-authorization/
SHA-256 integrity: 41052ab08fd07cf9a0ea49e3f316fed6681d0cdf39fa5709a480b1ec2c67367e
Primary Citations — 12 traced to source
- OWASP API Security Top 10 (2023), API03:2023 Broken Object Property Level Authorization, How To Prevent: 'When exposing an object using an API endpoint, always make sure that the user should have access to the object's properties you expose.'
- OWASP API Security Top 10 (2023), API03:2023 Broken Object Property Level Authorization, How To Prevent: 'Avoid using generic methods such as `to_json()` and `to_string()`. Instead, cherry-pick specific object properties you specifically want to return.'
+ 10 more citations (full bibliography, deterministic workflow, actionable schema and crosswalks) included in the vault unlock — $0.01 via Skyfire / L402 / Direct Base USDC.
Access
- Discovery (free): /api/v1/nodes/owasp-api-top-10-2023-api03-broken-object-property-level-authorization.json — 6-field metadata
- Vault (full node): /api/v1/vault/nodes/owasp-api-top-10-2023-api03-broken-object-property-level-authorization.json — full 13-key payload, $0.01 USDC (L402/Skyfire/Direct Base)
- Canonical URL: https://bidda.com/intelligence/owasp-api-top-10-2023-api03-broken-object-property-level-authorization
- Back to registry: Browse all 10,090 compliance nodes