Practice: Finding Five Weaknesses in One Endpoint

One profile update endpoint, its request, its response and its headers; find the five problems.

Reviewing an endpoint for these risks means checking each of the five questions against what it does. Here is one endpoint as it behaves today. Find five weaknesses and give the fix for each.

PATCH /users/{id} loads the user by id and copies every field in the body onto it. It checks only that the token is valid.
A request with {"displayName": "Maria", "isAdmin": true} returns 200 with the whole user record, including passwordHash.
The bio field accepts any length.
There is no rate limit; a script sent 20,000 updates in a minute.
Every response carries Access-Control-Allow-Origin set to the request's Origin, with Access-Control-Allow-Credentials: true, and the team says that keeps other callers out.

Show the answers

Each weakness, the evidence for it, and the fix
Risk	Evidence	Fix
Object level authorisation	Any valid token can update any user by id	Use PATCH /users/me, or check the id is the caller's; 404 otherwise
Mass assignment and exposure	isAdmin was accepted; passwordHash was returned	Allow-list displayName, bio and locale in; a designed response type out
Input validation	bio accepts any length	A schema with a maximum length, and a body size limit
Resource consumption	20,000 updates in a minute	A per-user rate limit with 429 and Retry-After
CORS	Any origin is reflected with credentials, and relied on for access	An allow-list of origins with Vary: Origin; access control stays on the server

← → move through sections and cards