API Privacy & Security
APIs are the primary vector for mass data exfiltration. If you expose incremental IDs, you will be scraped.
Broken Object Level Authorization (BOLA)
Formerly known as IDOR. If an attacker logs in, receives a token, and then requests `GET /api/users/45`, they should only get data if they *are* user 45. If the server fails to verify ownership, the attacker writes a loop to fetch users 1 through 10,000.
| Defense Mechanism | Implementation Detail |
|---|---|
| UUIDv4 instead of Integers | Prevents enumeration attacks. `GET /users/8f14e45f...` |
| Contextual Authorization | Compare JWT `sub` claim to the requested resource owner ID. |