API3-Excessive-Data-Exposure.md

Excessive Data Exposure

The code below is vulnureable to Excessive Data Exposure

// This code is for an API endpoint that allows users to view their profile information

// Check if the user is authenticated

if (!req.isAuthenticated()) {
  res.status(401).json({
    error: "Unauthorized"
  });
  return;
}

// Get the user's profile information from the database

User.findById(req.user.id, (err, user) => {
  if (err) {
    res.status(500).json({
      error: err
    });
    return;
  }

  // Return the user's profile information
  
  res.json({
    user: user
  });
});

Why it's vulnerable?

The code is returning the user's profile information when they access the API endpoint. However, the code is returning all of the user's profile information, including potentially sensitive information such as their password or credit card details.

Impact?

This is an example of excessive data exposure, because the code is returning more data than is necessary or appropriate for the specific request.

How to fix?

To avoid this type of vulnerability, it is important to carefully consider the amount and type of data that is being returned from an API endpoint. In this case, the code could be updated to only return the specific information that is needed for the request, such as the user's username and email address, and to exclude any sensitive information that should not be exposed. This would ensure that only the appropriate data is returned, reducing the risk of sensitive data exposure.