API Security & the OWASP API Top 10

// VULNERABLE: authenticated, but no ownership check. Changing the id in the
// URL returns someone else's order.
@GetMapping("/api/v1/orders/{id}")
public OrderResponse get(@PathVariable String id) {
    return orderService.find(id);
}
 
// FIXED: the query itself is scoped to the caller, so an id they do not own
// simply does not exist as far as this endpoint is concerned.
@GetMapping("/api/v1/orders/{id}")
public OrderResponse get(@PathVariable String id, @AuthenticationPrincipal Jwt jwt) {
    return orderService.findForCustomer(id, jwt.getSubject())
            .orElseThrow(() -> new ResourceNotFoundException("order", id));
}

// Scoping in the query is safer than fetching then checking, because there is
// no branch a future refactor can accidentally remove.
@Query("select o from Order o where o.id = :id and o.customerId = :customerId")
Optional<Order> findByIdAndCustomerId(@Param("id") String id,
                                      @Param("customerId") String customerId);

@Component("ownership")
public class OwnershipEvaluator {
    public boolean canAccess(Authentication auth, String orderId) {
        return orders.findById(orderId)
                     .map(o -> o.customerId().equals(auth.getName())
                            || auth.getAuthorities().contains(SUPPORT_ROLE))
                     .orElse(false);
    }
}
 
@PreAuthorize("@ownership.canAccess(authentication, #id)")
public OrderResponse get(@PathVariable String id) { }

// VULNERABLE: any field on the entity can be set from the request body,
// including ones the client should never control.
@PutMapping("/api/v1/users/{id}")
public User update(@PathVariable Long id, @RequestBody User user) {
    return userRepository.save(user);   // {"role":"ADMIN","creditBalance":999999}
}
 
// FIXED: the DTO declares exactly what a client may change. A field it does
// not contain cannot be set, no matter what the request body says.
public record UpdateProfileRequest(
    @NotBlank @Size(max = 100) String displayName,
    @Email String email,
    @Size(max = 500) String bio) { }
 
@PutMapping("/api/v1/users/{id}")
public UserResponse update(@PathVariable Long id,
                           @Valid @RequestBody UpdateProfileRequest request,
                           @AuthenticationPrincipal Jwt jwt) {
    if (!jwt.getSubject().equals(String.valueOf(id))) throw new AccessDeniedException("not yours");
    return userService.updateProfile(id, request);
}

// VULNERABLE: authenticated is the only requirement, so every ordinary user
// can call it.
@DeleteMapping("/api/v1/admin/users/{id}")
public void delete(@PathVariable Long id) { }
 
// FIXED: the capability is asserted on the method, so it holds however the
// caller arrived — HTTP, a message listener, or another service.
@DeleteMapping("/api/v1/admin/users/{id}")
@PreAuthorize("hasAuthority('USER_DELETE')")
public void delete(@PathVariable Long id) { }

@GetMapping("/api/v1/orders")
public Page<OrderResponse> list(
        // Without a cap, ?size=1000000 is a denial of service in one request.
        @PageableDefault(size = 20) @Valid Pageable pageable) {
    if (pageable.getPageSize() > 100) {
        throw new BadRequestException("maximum page size is 100");
    }
    return orderService.list(pageable);
}

spring:
  servlet:
    multipart:
      max-file-size: 20MB
      max-request-size: 60MB
server:
  tomcat:
    max-http-form-post-size: 2MB
    max-swallow-size: 25MB
    connection-timeout: 20s

@Component
public class SafeUrlFetcher {
 
    private static final List<IpAddressMatcher> BLOCKED = Stream.of(
            "127.0.0.0/8", "10.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16",
            "169.254.0.0/16", "0.0.0.0/8", "::1/128", "fc00::/7")
            .map(IpAddressMatcher::new).toList();
 
    public byte[] fetch(String rawUrl) {
        URI uri = URI.create(rawUrl);
 
        if (!Set.of("http", "https").contains(uri.getScheme())) {
            throw new BadRequestException("only http and https are permitted");
        }
 
        InetAddress resolved;
        try {
            resolved = InetAddress.getByName(uri.getHost());
        } catch (UnknownHostException ex) {
            throw new BadRequestException("host could not be resolved");
        }
 
        String ip = resolved.getHostAddress();
        if (BLOCKED.stream().anyMatch(matcher -> matcher.matches(ip))) {
            throw new BadRequestException("that address is not permitted");
        }
 
        // Connect to the IP we validated, not the hostname. Re-resolving here
        // reopens a DNS rebinding window between check and connect.
        return client.get()
                .uri(uriBuilder -> uriBuilder.scheme(uri.getScheme()).host(ip)
                        .port(uri.getPort()).path(uri.getPath()).build())
                .header(HttpHeaders.HOST, uri.getHost())
                .retrieve().body(byte[].class);
    }
}

@Test
void cannotReadAnotherCustomersOrder() throws Exception {
    mvc.perform(get("/api/v1/orders/{id}", orderBelongingToBob)
            .with(jwt().jwt(j -> j.subject("alice"))))
       // 404, not 403 — a 403 confirms the order exists.
       .andExpect(status().isNotFound());
}
 
@Test
void cannotEscalatePrivilegeViaRequestBody() throws Exception {
    mvc.perform(put("/api/v1/users/{id}", aliceId)
            .with(jwt().jwt(j -> j.subject(aliceId)))
            .contentType(APPLICATION_JSON)
            .content("""
                {"displayName":"Alice","role":"ADMIN","creditBalance":999999}
                """))
       .andExpect(status().isOk());
 
    assertThat(userRepository.findById(aliceId).orElseThrow().role()).isEqualTo(Role.USER);
}