A misconfiguration is an incorrect, unsafe, or insufficiently restrictive service setting that opens a security hole. In APIs, it can expose internal information, sensitive data, credentials, or operations to people who should not reach them. section 5.4
Common failures include leaving debug mode enabled, exposing internal APIs publicly, omitting authorization checks, making storage publicly accessible, and leaking API keys in client code. Attackers use the resulting information or access to plan attacks and reach confidential data. section 5.4
Debug mode leaks an API's internals
A GET /users endpoint accepts an order_by parameter. With FastAPI(debug=True), requesting /users?order_by=asdf produces a full stack trace containing file paths, runtime and library details, database information, code context, and the generated query. Set debug to False across every environment; also restrict order_by to an enumeration and verify fields before querying. section 5.5
Reduce misconfiguration risk by:
- Automate deployments and configuration management. section 5.9
- Run smoke tests that detect common configuration errors. section 5.9
- Treat internal APIs as public and protect them with authorization. section 5.4
