Tested fixes for the weaknesses API3:2023 maps, in Express, Flask, Spring Boot, ASP.NET Core, Next.js, FastAPI, Django, net/http, Rails and Laravel: the vulnerable code, the fix, a wrong fix and the regression tests.
Returning whole objects leaks fields the caller should not see, and binding whole request bodies lets callers change fields they should not. The 2023 edition combines excessive data exposure and mass assignment.
- Return only the fields each caller may read, using explicit response schemas.
- Accept only the fields each caller may write, and never bind request bodies directly to data models.
- Check requests and responses against those schemas in tests.
Guides on this site
Authorize functions and fields as well as objects
Prevent mass assignment, sensitive-field exposure and administrative actions that a valid object lookup alone cannot protect.
Authorization models: RBAC, ABAC, ReBAC and policy as code you can test
Translate roles, attributes and relationships into explicit subject-action-resource decisions, prevent broken object level authorization (BOLA), and verify ownership and tenant boundaries with tests.
Keep untrusted object keys out of prototype and authority paths
Trace an actual nested-merge mutation, replace it with a narrow schema, and make authorization independent of inherited properties.
Practice
- Mass assignment lab: Update only the fields users may edit · Browser lab
- Secure a real HTTP API · Local project
- Stop prototype pollution at merge and authorization boundaries · Local project
References
List data from the publisher. A guide is listed as the main subject when the weakness or risk is what the guide is about, and as covering it when a dedicated section or worked example addresses it.