Безпека API
на практиці

Call staff-only endpoints from a read-only account.

• Reach admin routes as an analyst
• Pull a roster and queue a payout
• Add a router-level role guard

Swap an id and read another rider.

• Change the object id in a request
• Harvest records by walking ids
• Enforce per-object ownership

Brute-force a six-digit login code.

• Attack an unlimited verify endpoint
• Take over with only an email
• Rate-limit per account with 429

Read the fields the UI never shows.

• Compare rendered page to raw JSON
• Find phone, birth date, coordinates
• Serialize a field allow-list

Read records through a retired API version.

• Swap v2 for a deprecated v1
• Bypass controls the new version enforces
• Retire old versions with 410 Gone

Turn a search box into a full database read.

• Break out of a catalog query
• UNION-dump the users table
• Parameterize so input stays data

Look up a customer and leave no trace.

• Access a record with no ticket
• See why no one can attribute it
• Add audit records and alerts

Mint a loyalty balance with two extra keys.

• Add fields to a PATCH body
• Write attributes you should not own
• Bind only editable fields

Read a signed-in account from any website.

• Reflect an arbitrary CORS origin
• Weaponize a lure page
• Lock CORS to an allow-list

Scrape a catalog with one oversized request.

• Set page size from the request
• Pull 250,000 records at once
• Cap page size server-side