An API endpoint is a network-accessible interface location that exposes one or more operations. Designing endpoints clearly helps make APIs secure and reliable. section 1.2.1
Endpoints can become attack paths when they expose user data without enforcing credentials. Repeated calls to a user-search endpoint can enumerate existing users, whose identifiers can then be submitted to another endpoint to retrieve personal details. section 11.6
Endpoint abuse through object enumeration
An attacker repeatedly calls GET /api/user/search/{username} to collect user IDs, then sends those IDs in the body of POST /stats/workouts/details. The second endpoint returns profiles containing age, location, and gender. The repeated calls against one endpoint form the attack signature. section 11.6
Design and review endpoints with these checks:
- Define each endpoint's operations clearly. section 1.2.1
- Apply pagination, avoid predictable resource IDs, validate data, and constrain user input. section 1.2.1
- Watch for repeated calls against the same endpoint as a possible enumeration signal. section 11.6
Figure 11.12 Peloton’s user search endpoint could be exploited to enumerate existing users and pull their details. The signature of this type of abuse is the repeated number of calls against the same endpoint to scrape the data.
Shows how repeated requests to a user-search endpoint can enumerate users and lead to personal-data exposure. section 11.6
