Question

A development team exposes a REST API for a multi-tenant cloud SaaS. During a security review, a tester finds that by changing the numeric 'accountId' parameter in the URL (e.g., /api/v1/accounts/1042/invoices), they can retrieve invoices belonging to other tenants even though the JWT they present is valid for only their own account. The endpoint authenticates the token correctly but returns data without further checks. Which control best addresses this OWASP API Security Top 10 weakness?

Accepted Answer

Enforce per-object authorization on every request by validating that the authenticated principal is entitled to the specific resource identified in the path or body

Answer

Add rate limiting to the endpoint to slow down automated enumeration of account IDs

Answer

Replace sequential numeric IDs with random UUIDs so identifiers cannot be guessed

Answer

Shorten the JWT expiration time and rotate signing keys more frequently