medium10 pts · first answer countsapi-testingnegative-testingapi-security

Sorting by a field that does not exist

GET /products?sort=price works. What should happen with GET /products?sort=passwordHash or sort=foo;DROP?

A.400 with a list of allowed sort fieldsB.200 sorted by passwordHashC.500 from the database layerD.200 with the sort silently applied

Discussion 0

Join free to post in the discussion.