Return only the fields needed

How to do it

Build each reply from an explicit list of fields. Never return the stored object directly. Keep separate lists for the owner, other users and staff.

Examples

JavaScript example

// Good: name the fields
res.json({ id: user.id, name: user.displayName });
// Bad: everything in the record, including the password hash
res.json(user);

Python example

# Python with Flask
return jsonify(id=user.id, name=user.display_name)

PHP example

// PHP with Laravel
return response()->json(['id' => $user->id, 'name' => $user->display_name]);

How to check

The agent reads replies about other users as a normal user. It finds no email address, password hash, internal note or field the page never shows.

Sources

• OWASP API3:2023 Broken Object Property Level Authorization

Related rules

• API-10 Give every response one shape in API design
• DAT-12 Select only the columns you use in Data and databases
• APP-75 Mask sensitive values until people ask to see them in Web app interface