Vulnerable API design contains security weaknesses in an API’s specified behavior or constraints. Attackers exploit requests that look legitimate, so the problem belongs in design—not only implementation. section 6.1 section 6.7
Unconstrained pagination
A GET /products endpoint might accept optional integer parameters named page and perPage. Without minimum and maximum limits, an attacker can request 100 million products, creating severe server performance problems. Constrain page to 1–100 and perPage to 10–100. section 6.1
Figure 6.1 We use pagination to slice a large collection of items into smaller chunks. On an e-commerce website, for example, we use pagination to let users retrieve a few products at a time when browsing the catalog.
Shows how pagination divides a large product collection into smaller responses, making the design trade-off concrete. section 6.1
Check API designs for weaknesses such as:
- Predictable identifiers that enable resource scanning. section 6.7
- Unconstrained strings, optional model properties, additional payload properties, or shared input/output schemas. section 6.7
- Business flows that can be abused to produce undesired outcomes; enforce the flow and track API interactions. section 6.7
