Unconstrained user input is client-supplied data accepted by an API without effective limits on values, size, type, or format. It can appear in request bodies, URL query and path parameters, or headers. Because this data reaches business and data layers, attackers can use it to overload systems, trigger errors, expose hidden fields, or inject database commands. section 6.3
Constrain inputs at the API boundary:
- Validate directly at the API rather than relying on a web or mobile client to restrict choices. section 6.3
Book review endpoint
An unconstrained review schema accepts POST /books/1/reviews with {"rating": 500} and permits unbounded review text. A safer schema restricts rating to 1–5 and review text to 2,000 characters.
