"We'll Filter It in the App"
Excessive Data Exposure happens when an API returns more data than the client needs, relying on the frontend to hide the sensitive parts. It's the digital equivalent of handing someone your entire filing cabinet because they asked for one document, trusting them not to read the rest.
This vulnerability is almost always a shortcut: the backend developer returns the full database object because it's easy, and assumes the mobile app or frontend will only display the relevant fields.
A Concrete Example
A dating app displays a list of potential matches. The UI shows: Name, Age, and Photo.
The backend code:
// GET /api/matches
app.get('/api/matches', async (req, res) => {
const users = await User.findAll(); // Returns entire DB rows
res.json(users);
});
What the phone actually receives:
[
{
"name": "Alice",
"age": 28,
"photo": "https://cdn.example.com/alice.jpg",
"location_exact_lat_long": "40.7128,-74.0060",
"email": "[email protected]",
"password_hash": "$2b$10$...",
"is_premium_subscriber": true,
"internal_risk_score": 3
}
]
The developer assumed: "If I don't show it on the screen, it's safe." This is false. An attacker uses a proxy tool like Burp Suite or even browser developer tools to intercept the raw JSON response. The app renders only Name, Age, and Photo — but the attacker sees Alice's exact GPS coordinates, email address, password hash, and internal account flags.
The Fix: Response Shaping and Principle of Least Privilege
The correct approach is to return only the fields the client legitimately needs. This is called response shaping or constructing a DTO (Data Transfer Object). Even better: use a SELECT query that never fetches sensitive columns from the database in the first place, so the data never enters memory on the server.
// Better: Only fetch what you need from the DB
const users = await User.findAll({
attributes: ['name', 'age', 'photoUrl'] // Never fetches password_hash, email, etc.
});
The principle at work here is Least Privilege: every component of a system should access only the minimum data necessary to perform its function. Applied to APIs, this means every endpoint's response payload should be the minimum required for the client's stated purpose.