domains / families / security / exploiting-excessive-data-exposure-in-api

exploiting-excessive-data-exposure-in-api

separate

Tests APIs for excessive data exposure (OWASP API3:2023) by intercepting raw API responses and comparing them against what the UI actually renders, looking for leaked PII, internal identifiers, debug data, or business-sensitive fields the frontend filters but the API still transmits. Use when auditing REST or mobile-app APIs for over-fetching, response filtering bypass, or unintended data leakage in endpoint responses.

When to use

• Testing APIs where the frontend displays a subset of data but the API response includes additional fields
• Assessing mobile application APIs where responses are designed for multiple client types and may contain excess data
• Identifying PII leakage in API responses that include email addresses, phone numbers, SSNs, or payment data not shown in the UI
• Testing GraphQL APIs where clients can request arbitrary fields including sensitive attributes
• Evaluating APIs after microservice refactoring where internal service-to-service data leaks into public endpoints

When not to use

• unauthorized testing without written authorization

Skill page

Source