Resource enumeration discovers which resources exist by manipulating identifiers in resource URLs. With an endpoint such as /payments/{payment_id}, sequential IDs invite probing for records belonging to other users. section 6.2
Enumeration becomes a data-breach risk when predictable IDs meet weak authorization. Attackers can scan resources, while response timing can also reveal information through a side-channel. section 6.2 section 4.3
Reduce the opportunity to enumerate resources by:
- Avoid exposing predictable identifiers directly through the API; use string-based identifiers at the database or application level. section 6.2
- Check that the authenticated user has rights to the requested resource, and test every endpoint for BOLA. section 4.3
- Look for response-time differences that disclose whether resources exist, then consider consistent response times. section 4.3
Orders endpoint
A request for /orders/1 may return an order without confirming ownership. Querying by both order ID and the authenticated user's identity prevents access to another user's order.
