API Trust Boundaries 101: What They Are, Where They Break, and How APIs Get Compromised

"Payment provider says this invoice is paid."
"Identity provider says this token belongs to user 123."
"Internal service says this user is an admin."
"Webhook says the order is completed."
"URL parameter says fetch this remote resource."

// Dangerous mindset:
// "This value came from another service, so it must be safe."

if (paymentWebhook.status === "paid") {
  await db.users.update({
    where: { id: paymentWebhook.userId },
    data: { premium: true },
  });
}

// ❌ Vulnerable webhook handler
app.post("/api/webhooks/payment", async (req, res) => {
  const event = req.body;

  if (event.type === "invoice.paid") {
    await db.subscription.update({
      where: { userId: event.userId },
      data: { plan: "pro", active: true },
    });
  }

  res.status(200).json({ ok: true });
});

// ✅ Safer webhook handler
import crypto from "crypto";

function verifySignature(rawBody: string, signature: string, secret: string) {
  const expected = crypto
    .createHmac("sha256", secret)
    .update(rawBody)
    .digest("hex");

  return crypto.timingSafeEqual(
    Buffer.from(expected),
    Buffer.from(signature)
  );
}

app.post("/api/webhooks/payment", async (req, res) => {
  const rawBody = req.rawBody;
  const signature = req.header("x-signature") || "";

  if (!verifySignature(rawBody, signature, process.env.WEBHOOK_SECRET!)) {
    return res.status(401).json({ error: "invalid signature" });
  }

  const event = JSON.parse(rawBody);

  // replay protection
  const seen = await db.webhookEvent.findUnique({
    where: { externalEventId: event.id },
  });

  if (seen) {
    return res.status(200).json({ ok: true });
  }

  // fetch authoritative object state instead of trusting the event blindly
  const invoice = await paymentProvider.getInvoice(event.invoiceId);

  if (!invoice || invoice.status !== "paid") {
    return res.status(400).json({ error: "invoice not confirmed" });
  }

  // verify the business linkage
  const subscription = await db.subscription.findUnique({
    where: { id: invoice.metadata.subscriptionId },
  });

  if (!subscription || subscription.userId !== invoice.metadata.userId) {
    return res.status(403).json({ error: "ownership mismatch" });
  }

  await db.subscription.update({
    where: { id: subscription.id },
    data: { plan: "pro", active: true },
  });

  await db.webhookEvent.create({
    data: { externalEventId: event.id },
  });

  return res.status(200).json({ ok: true });
});

// ❌ Vulnerable pattern
// Orders service trusts role headers forwarded by another service

app.get("/api/admin/orders", async (req, res) => {
  if (req.header("x-user-role") === "admin") {
    const orders = await db.orders.findMany();
    return res.json(orders);
  }

  return res.status(403).json({ error: "forbidden" });
});

// ✅ Safer pattern
// Verify service identity and resolve authorization from trusted server-side state

app.get("/api/admin/orders", async (req, res) => {
  const serviceToken = req.header("authorization") || "";

  const caller = await verifyServiceToken(serviceToken);
  if (!caller || caller.service !== "api-gateway") {
    return res.status(401).json({ error: "untrusted caller" });
  }

  const userId = req.header("x-authenticated-user-id");
  if (!userId) {
    return res.status(400).json({ error: "missing user context" });
  }

  const user = await db.users.findUnique({ where: { id: userId } });
  if (!user || user.role !== "admin") {
    return res.status(403).json({ error: "forbidden" });
  }

  const orders = await db.orders.findMany();
  return res.json(orders);
});

// ❌ Vulnerable: user controls what the server fetches
app.post("/api/preview", async (req, res) => {
  const { url } = req.body;
  const response = await fetch(url);
  const html = await response.text();

  res.json({ preview: html.slice(0, 500) });
});

// ✅ Safer: strict allowlist + DNS/IP controls + protocol checks
const ALLOWED_HOSTS = new Set(["images.example-cdn.com", "partner.example.com"]);

function isPrivateIp(hostname: string): boolean {
  // simplified placeholder
  return ["127.0.0.1", "169.254.169.254", "localhost"].includes(hostname);
}

app.post("/api/preview", async (req, res) => {
  const { url } = req.body;
  let parsed: URL;

  try {
    parsed = new URL(url);
  } catch {
    return res.status(400).json({ error: "invalid url" });
  }

  if (parsed.protocol !== "https:") {
    return res.status(400).json({ error: "only https allowed" });
  }

  if (!ALLOWED_HOSTS.has(parsed.hostname)) {
    return res.status(403).json({ error: "host not allowed" });
  }

  if (isPrivateIp(parsed.hostname)) {
    return res.status(403).json({ error: "private targets blocked" });
  }

  const response = await fetch(parsed.toString(), {
    redirect: "error",
  });

  const contentType = response.headers.get("content-type") || "";
  if (!contentType.startsWith("text/html")) {
    return res.status(400).json({ error: "unexpected content type" });
  }

  const html = await response.text();
  return res.json({ preview: html.slice(0, 500) });
});