Type Confusion (in APIs)

The API expects a string.

Type Confusion (in APIs)

The API expects a string.

Category: Web · OWASP Top 10

🎯 Trench — The API expects a string. You send an array, a boolean, or a nested object. The strongly-typed parser panics and throws a complete stack trace, exposing the framework.

🔗 Kill chain — Passive recon. Not an exploit per se; gives you the backend fingerprint (Spring Boot, Laravel, Express) without firing the WAF.

📡 Defensive footprint — The error itself isn’t alarming for the WAF (no SQL, no XSS), but it should be logged as uncaught exception.

⚠️ False friend — Trusting Server: Cloudflare to assume opacity. Cloudflare hides headers, not application errors.

🛡️ Remediation — Global exception handler returning sterile responses. Same HTTP code, same body, regardless of what failed.

// Express global middleware
app.use((err, req, res, next) => {
  console.error(err); // internal log
  res.status(400).json({ status: 400, error: "Invalid payload" });
});

---

← Back to the full glossary

Last updated: 2026-06-11