CyberCertPrepWeb App FundamentalsAPIs & RESTEASYFree question
A developer designs a REST API for a social platform. Users can follow each other. DELETE /api/follows/{id} removes a follow relationship. A logged-in user submits DELETE /api/follows/789. The API must check what before performing the deletion?
- A.Only that the follow relationship with ID 789 exists
- B.That the authenticated user is the owner of follow relationship 789 (i.e., they are the follower, not the followed, and they created this specific relationship). An attacker could submit DELETE for any follow ID - the API must verify object ownership before any destructive operation
- C.Only that the user is authenticated
- D.That the follow ID is a valid integer
Why B is correct
Every destructive REST operation must verify: (1) authentication - who is the caller; (2) authorization - does this caller own/have permission to modify this specific resource instance. An attacker who knows or enumerates follow relationship IDs could unfollow any user from any account without this check. This is IDOR (Insecure Direct Object Reference). The pattern: load the resource by ID, verify the authenticated user's relationship to it, then perform the action.
Know someone studying for Web App Fundamentals? Send them this one.