← Back to Application Programming Interface (API) Security Requirements Guide

V-274709

CAT I (High)

The amount of data returned by the API must be restricted.

Rule ID

SV-274709r1143744_rule

STIG

Application Programming Interface (API) Security Requirements Guide

Version

V1R1

CCIs

CCI-002418

Discussion

Restrict exposing excessively large sets of data that could be used to discover vulnerabilities or extract sensitive information. This will protect sensitive information and prevent performance bottlenecks caused by returning large, unnecessary datasets.

Check Content

Verify the amount of data returned by the API is restricted.

Check API endpoints: 
Review the various API endpoints and the data they return. Look for endpoints that might expose excessively large datasets or sensitive information (e.g., entire user lists, full transaction histories).

If the API exposes unusually large volumes of data in a single response (entire datasets, unrestricted record sets, or bulk exports without proper limits or pagination) this is a finding.

Fix Text

Ensure API responses are small and contain only the data necessary for the client's request.

To ensure that the amount of data returned by an API is appropriately restricted, implement and test measures like pagination, field filtering, query parameters, server-side limits, and proper access control.