EC-Council Certified Ethical Hacker (CEH) v12Web Application HackingMedium
A web application developer is designing a new API endpoint that accepts JSON payloads containing user data. To prevent malicious data from being processed, the developer wants to ensure that all incoming JSON data strictly conforms to a predefined schema, rejecting any requests with extra fields or incorrect data types. Which web application security concept is the developer implementing?
- AContent Security Policy (CSP)
- BOutput Encoding
- CSchema Validation
- DRate Limiting
Show answer & explanationAnswer & explanation
Correct answer: C. Schema Validation
Schema Validation is the process of ensuring that incoming data (like JSON payloads) conforms to a predefined structure, data types, and constraints, which helps prevent various injection and malformed data attacks.
Why the other options are wrong
- A. CSP is a security mechanism that helps mitigate XSS and data injection attacks by specifying trusted content sources.
- B. Output Encoding is used to prevent XSS by encoding data before displaying it to the user.
- D. Rate Limiting controls the number of requests a user can make in a given period to prevent brute-force attacks or DoS.
Schema Validation
Schema Validation is the process of verifying that a given data structure (like XML or JSON) conforms to a predefined schema, ensuring correctness and integrity.
- Enforces data types, field names, required fields, and structural constraints.
- Prevents malformed data from being processed, reducing attack surface.
- Commonly used for API inputs and configuration files.
Memory trick: APIs Guard Data with Strict Schemas.