Data vulnerabilities

Data vulnerabilities are one of the most significant weaknesses impacting API security, with nearly all breaches involving data leakage to some extent. For API defenders, the good news is that it is a vulnerability class that can be defended using some core principles and techniques.

Let us start our journey by understanding how data propagates through an API from the request, via the API layer, then the database layer, where it will be persisted to a database storage layer. A response follows the reverse flow: data is accessed from the database via the database layer, processed by the API layer, and returned to the user or client in the response.

This is summarized in the following simplified architecture diagram:

Figure 9.3 – Typical API data controller model

There are three data processing layers, each with its own data object:

• Data input object: This is the native input format data received in the API request...