Issue Details
Excessive Data Exposure
api03-2019 • Rank #3 in OWASP 2023
Explanation
Excessive data exposure occurs when APIs return entire objects and rely on clients to hide fields. Attackers inspect raw responses to extract secrets, internal identifiers, PII, or business-sensitive attributes not intended for their role. This problem is common in generic serializers and reused DTOs where sensitive fields leak through default mappings.
Remedy
Adopt explicit response allowlists per endpoint and role. Build contract-driven serializers that include only required fields, and block sensitive attributes by default. Add automated response schema tests for overexposure regressions and run data classification checks to prevent accidental leakage of regulated information.
| Year | Rank | Category |
|---|---|---|
| 2019 | #3 | api03-2019 - Excessive Data Exposure |