Excessive data exposure occurs when APIs return entire objects and rely on clients to hide fields. Attackers inspect raw responses to extract secrets, internal identifiers, PII, or business-sensitive attributes not intended for their role. This problem is common in generic serializers and reused DTOs where sensitive fields leak through default mappings.
Adopt explicit response allowlists per endpoint and role. Build contract-driven serializers that include only required fields, and block sensitive attributes by default. Add automated response schema tests for overexposure regressions and run data classification checks to prevent accidental leakage of regulated information.
The same feature written the risky way, then with the fix applied.
How this risk has ranked in each OWASP release.
2019Latest
#03api03-2019 Excessive Data Exposure
