CyberCertPrepWeb App FundamentalsAPIs & RESTEASYFree question
A REST API's response to GET /users/me includes: {'id': 1, 'email': 'user@example.com', 'passwordHash': '$2b$10$...', 'internalNotes': 'flagged for fraud'}. What problem does this illustrate?
- A.Mass assignment via the response
- B.Excessive Data Exposure - the API returns sensitive internal fields (password hash, internal notes) that the client should never receive, trusting the client to filter display data
- C.BOLA because the user can see their own data
- D.Cryptographic failure because the hash is visible
Why B is correct
Returning full model objects and expecting the UI to hide sensitive fields is a common design mistake. The API must serialize only the fields the consumer legitimately needs. A serializer or response DTO should explicitly list allowed fields. Even if the frontend never displays passwordHash or internalNotes, they are visible in DevTools and intercepting proxies.
Know someone studying for Web App Fundamentals? Send them this one.