Profile My skills Saved Collections Edit profile Submit a skill

Excessive Data Exposure in API Responses

Detects API endpoints that return more data than required, including sensitive fields that clients should not receive.

zakirkun Updated
Integrations & APIs

File contents

Excessive Data Exposure

Overview

APIs that return complete database objects rely on the frontend to filter sensitive fields. This is a common vulnerability (OWASP API3) where:

  • Password hashes returned in user objects
  • Internal IDs, audit timestamps exposed
  • Admin-only fields visible to all users
  • Credit card details partially exposed

Remediation

  • Use Data Transfer Objects (DTOs) that explicitly define what fields to return
  • Never return entire database models directly
  • Use field-level serialization control (@JsonIgnore, exclude, select)

zakirkun/ice-tea/tree/main/skills/api/excessive-data-exposure commit 18a9c27aca

Browse category

Frequently asked questions

npx skillmds@latest add zakirkun/excessive-data-exposure-in-api-responses