liveBook · Manning

Index-based pagination

As explained in Secure APIs

Offset-based pagination retrieves a collection by specifying the number of items to skip and the number of items to return.

Index-based pagination retrieves a collection in smaller chunks by specifying how many items to skip and how many to return. section 6.1

It becomes a security concern when pagination parameters accept unbounded values. A request for 100 million products can pressure the database, and many concurrent requests can cause denial of service. section 6.1

A safer products endpoint

GET /products?page=5&perPage=10 requests a manageable slice. Define page with minimum 1 and maximum 100, and perPage with minimum 10 and maximum 100; document defaults rather than relying on presumed sensible values. section 6.1

Listing 6.2 Secure pagination
# file: ch06/6_1_safe_pagination.yaml
paths:
  /products:
    get:
      parameters:
        - name: page
          in: query
          required: false
          schema:
            type: integer
            minimum: 1
            maximum: 100
        - name: perPage
          in: query
          required: false
          schema:
            type: integer
            minimum: 10
            maximum: 100

Compare the vulnerable unconstrained schema with the bounded OpenAPI definition. section 6.1

How Secure APIs covers it

How deep it goes
Explains pagination patterns and demonstrates parameter bounds, stopping short of implementation code.
Examples
Uses a products endpoint, oversized perPage requests, and vulnerable versus secure OpenAPI schemas.
What it assumes
Assumes familiarity with API query parameters while establishing pagination and design-time security concerns.
What you can do after
Operate/configure it by bounding pagination parameters and documenting their defaults.
How it connects
Connects offset-based pagination with page-based pagination, cursor-based pagination, API design, and denial-of-service attacks.
Cover of Secure APIs
liveBookmanning.com
Read Secure APIs on liveBook Get the book at manning.com

Related concepts

This explainer was generated by Manning's knowledge graph from the text of Secure APIs. The section links point to the parts of the book it draws on.