A side-channel attack infers internal information from characteristics a system exposes unintentionally, rather than from its intended outputs. section 4.3
For APIs, an attacker can compare request-response latencies for existing and nonexistent resources. Consistent timing differences may reveal resource identifiers and enable enumeration. section 4.3
Timing reveals resource existence
An endpoint may return the same apparent result for two resource requests, yet respond faster for a nonexistent record. Repeated measurements let an attacker distinguish which identifiers exist. section 4.3
Reduce timing-based leakage by:
- Checking whether the API responds with different latencies for existing and nonexistent resources. section 4.3
- Putting measures in place to deliver consistent response times across requests when timing differences appear. section 4.3
