Why "the partner API" is not a trust boundary
Every developer validates input from users. Very few validate the response from an upstream API — and API10 exists for that reason.
The reason for skipping it sounds sensible: "that is our partner's API, we have a contract". But a contract is not a technical control, and there are four ways that response turns malicious without your partner intending anything:
| Route | Example |
|---|
The partner is compromised | m6-challenge itself — their pipeline, not their intent |
| MITM on the route to them | tls-and-transport, the => true line |
| Your own SSRF | You think you are calling the partner; you are calling wherever the attacker chose |
| The partner changes the contract | Not malicious, same consequence: the response is not what you assumed |
The third row is the most notable because it ties this module together: if you have SSRF then every assumption about "the partner's response" becomes an assumption about "the attacker's response". The two holes multiply rather than add.
Five commonly made and commonly wrong assumptions:
| Assumption | How it breaks |
|---|---|
| The response is valid JSON | An HTML error page, or a different Content-Type |
| A reasonable size | A 4 GB response exhausting process memory |
| It returns within seconds | An infinitely slow drip holding your connection and thread |
| Fields have their documented types | "amount": "1e999", "id": null where required |
| Strings in it are safe to render | It reaches innerHTML and becomes XSS |
The third row deserves its own note because it is not a data problem but a resource-exhaustion attack: a server sending one byte every 20 seconds holds one of your threads indefinitely, and HttpClient.Timeout defaults to 100 seconds for the whole request — but it does not bound body-read time if you stream it.
Comments
Commenting needs an account with at least one completed lesson. That condition is what keeps this thread worth reading: every point belongs to someone who can be asked back, and reputation accrues over time.
You can still read every comment below without an account. Signing in brings you back to this exact spot, not to the top of the page.
Loading comments…