A new note was added to API1:2023 (Broken Object Level Authorization) clarifying that GUIDs/UUIDs are not an authorization control (see #155 / #154). It was added to editions/2023/id/0xa1-broken-object-level-authorization.md in English as a placeholder so it wouldn't be missed.
This issue tracks translating that note into Indonesian to match the rest of the document.
The note currently reads:
Note
-
Using GUIDs/UUIDs instead of predictable identifiers helps mitigate object enumeration attacks. However, once a valid identifier is disclosed—whether through another endpoint, excessive data exposure, logging, or another vulnerability—it should be treated as public information.
-
Authorization decisions must never rely on the secrecy or unpredictability of object identifiers. Every request must independently verify that the authenticated user is authorized to access the requested object.
A new note was added to API1:2023 (Broken Object Level Authorization) clarifying that GUIDs/UUIDs are not an authorization control (see #155 / #154). It was added to
editions/2023/id/0xa1-broken-object-level-authorization.mdin English as a placeholder so it wouldn't be missed.This issue tracks translating that note into Indonesian to match the rest of the document.
The note currently reads: