List endpoints can disclose data that individual-object checks correctly protect. Pagination parameters must not expand authority.
Evaluation approach
Enforce filters and field selection server-side. Unauthorized fields must be absent from the response, not merely hidden.
Application example
Separate public employee names from private phone numbers and cap page sizes to control resource use.
Limits and considerations
Not displaying a received field is not data minimization.
Do list and detail routes agree?
Compare both responses under the same role. A secure detail endpoint can coexist with an overexposing list endpoint. Hidden JSON fields are still transmitted data.
Checks and decisions
- Reduce response fields
- Limit page size
- Test filter authorization
Sources
The primary references above provide the technical basis. Example workflows and evaluation suggestions are this publication’s explanations, not independent test results for a particular product.