Secure API

Validating a token is a library call. The question that follows — may this caller see this particular record — is the one APIs get wrong, and it is first on the OWASP API Security list because getting it wrong leaks everything at once.

It cannot be answered by a URL pattern or a scope, because the answer depends on the record rather than the route. A caller with a perfectly valid token and the correct scope, asking for an id belonging to another tenant, must be refused. The check therefore lives in the service, where the record is in hand, and the tenant comes from a claim in the token rather than from a parameter — a caller who can name their own tenant is self-certifying every check downstream.

A record belonging to another tenant and a record that does not exist return byte-identical responses. Answering 403 for one and 404 for the other confirms which ids are real, which is precisely what someone walking an id space is trying to learn — the refusal itself becomes the data.

The test does not check the status codes separately. It performs both requests and asserts the response bodies are equal, because that is the property that matters.

National IDs are encrypted per field before storage, so whatever sits behind the repository — a table, a nightly backup, a read replica with looser access — never contains a readable one.

GCM rather than CBC, because it authenticates as well as encrypts: with CBC, an attacker able to modify stored ciphertext can flip bits in the plaintext and the application decrypts the result without complaint. A fresh IV per encryption, because deterministic encryption leaks equality — an observer could tell which subscribers share a value without decrypting anything. And the record id is bound in as additional authenticated data, so a ciphertext lifted from one row and pasted into another simply fails to decrypt.

Decryption failures are deliberately uninformative. Distinguishing wrong key from tampered from wrong record in the error message hands an attacker an oracle.

The limiter is a token bucket keyed on the authenticated subject, not the IP address. Keying on IP punishes everyone behind a shared connection for one noisy client, and does nothing about a single credential used from many addresses — which is the shape of scraping and credential-stuffing traffic. A bucket rather than a fixed window, because a fixed window permits double the intended rate across its boundary.

Every access to personal data is audited, including refusals. One 403 is somebody mistyping an id; two hundred from one subject is an enumeration attack, and only the log tells them apart. The entries carry the record id and never its contents — an audit trail that quotes the data it protects has just copied it somewhere with weaker access controls.