Understanding business logic vulnerabilities

To understand what types of vulnerabilities may arise from the business logic behind API endpoints and their applications, we first have to understand what business logic is. Well, it is nothing other than several processes, rules, and workflows that define how data can be processed by software. To reach specific business objectives, the software needs to handle interactions with the users, as well as transactions and data handling. In other words, it’s the implementation of business specificities into code.

Using web commerce as a common scenario, the business logic part of the application (that could also be represented by APIs and their endpoints) handles various tasks such as the maintenance of the shopping cart, the insertion of discount codes, all logistics activities (such as calculating shipping costs and estimated delivery time), and finally, the processing or transferring to a trusted third party of payments. The final...