Property enumeration is an exploit that reveals fields in an application's data models that should remain hidden from external users. Attackers can expose these fields through seemingly harmless API parameters. section 3.1
Sorting by a hidden field
Suppose GET /products accepts sort_by for price or average review. If the API accepts any word, an attacker can request sort_by=stock and learn each product's remaining inventory. That information can support scalping: buying scarce products to resell them at higher prices. A regular expression that blocks spaces or SQL syntax may stop SQL injection while still allowing this attack. section 3.1
Prevent property enumeration by:
- Constraining sort_by to an explicit enumeration of permitted fields, rather than accepting arbitrary property names. section 3.1
- Assessing API security early and repeatedly during development instead of relying only on end-stage security tests. section 3.1
