output-filter-pattern

name	output-filter-pattern
description	Security pattern for filtering data before sending to external entities. Use when preventing excessive data exposure, implementing data minimization, protecting sensitive information in API responses, or ensuring clients receive only necessary data. Addresses "Entity receives excessive data" problem and OWASP API3:2019 Excessive Data Exposure.

Output Filter Security Pattern

Filter data before sending it to an external entity, ensuring that only necessary and authorized data elements are transmitted. This prevents excessive data exposure and enforces data minimization.

Problem Addressed

Entity receives excessive data: System sends more data than the receiver needs or is authorized to see, leading to:

• Exposure of sensitive data (PII, credentials, internal identifiers)
• Privacy violations (GDPR, CCPA)
• Increased attack surface
• Data leakage through traffic interception

Core Principle

Never rely on the client to filter sensitive data.

Data filtering must occur at the server/API level before sending, not at the client level after receiving.

Why Client-Side Filtering Fails

Attack Vector	Description
Traffic sniffing	Attackers intercept API responses before client filtering
Direct API calls	Attackers bypass client applications entirely
Client manipulation	Attackers modify client code to reveal hidden data
Mobile app reverse engineering	Attackers extract API endpoints and call directly

Core Components