Unrestricted access to sensitive business flows occurs when attackers abuse an API’s intended business rules or action sequences for personal gain or to harm the business. The flaw is not necessarily a broken technical control; it is a business process that permits unlimited, unauthenticated, or poorly validated use. section 4.9 section 1.4
Common targets include referral rewards, promotional codes, product inventories, ticket sales, appointments, reviews, and data collection. Attackers may create fake accounts, reuse coupons, manipulate reviews, scrape content, or automate purchases faster than legitimate users. section 1.4 section 4.9
Referral rewards and scalper bots
Suppose user A receives a discount whenever user B joins a ride-sharing platform. If the API does not verify that user B is genuine, user A can create unlimited fake accounts and earn endless rewards. Similarly, a scalper bot can poll an API from different IP addresses, detect newly available products or tickets, and buy the entire stock for resale. The result is financial loss, poor customer experience, and unnecessary API load. section 4.9
Reduce exposure by combining design constraints, detection, and flow-specific testing:
- Constrain how users can engage with sensitive flows instead of assuming ordinary authentication will prevent abuse. section 4.11
- Validate account authenticity, coupon ownership, one-time use, purchase limits, and other business invariants at the API boundary. section 12.5
- Threat-model the business domain and write tests because generic web application firewalls may not recognize logic-specific abuse. section 12.5
Testing coupon abuse
Create fixtures for a newly registered student, that student’s voucher, and a course. Test that the same student cannot reuse the voucher, then authenticate a different student and test that they cannot use the first student’s voucher; the latter should return HTTP 403.
