thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Application & OT Security · Intermediate

Excessive Data Exposure

An API flaw (API3:2019) where endpoints return more data than the client needs and rely on the client to filter it.

Definition

Developers often return entire database objects and let the UI hide fields, but attackers read raw responses. Mitigation is server-side response filtering with explicit schemas. In 2023 it merged into BOPLA.

Example

The /users endpoint returns password hashes and internal flags that the mobile app simply does not display.

Exam tip

Never rely on the client to filter sensitive data.

Related terms