CyberCertPrepWeb App FundamentalsAPIs & RESTEASYFree question
A REST API for a hospital returns GET /patients and lists ALL patients in the database for any authenticated user. A ward clerk can see ICU patients. Which REST API security principle is violated?
- A.The API violates rate limiting principles
- B.Object-level authorization (IDOR / OWASP API1): the API does not restrict the data to only what the requesting user is authorized to access. Each user should only see data within their scope of care
- C.The API violates statelessness by returning all patients
- D.This is acceptable - all hospital staff are trusted employees
Why B is correct
OWASP API Security API1:2023 - Broken Object Level Authorization is the most common API security flaw. Every API endpoint that returns data must verify the authenticated user is authorized to access that specific data, not just that they are authenticated. In healthcare, this means enforcing context-based access (ward, care relationship, role) on every query, not just at login.
Know someone studying for Web App Fundamentals? Send them this one.