Direct answer
Pagination must not weaken the same authorization rules that apply to the first page. Each request and returned record should remain scoped to the authenticated caller and intended sharing policy.
Prepare distinct test data
Create two authorized accounts in separate test tenants and enough labeled records to span multiple pages. Document intended sharing, sort order and whether the API uses offsets or opaque cursors. Use only synthetic data with a known owner.
Reference: OWASP API1:2023 Broken Object Level Authorization.
Walk and compare pages
List records as each account, follow every issued cursor and verify each returned object belongs to the expected scope. Compare total counts and next-page indicators as well as the records themselves. A safe first page does not establish that later pages preserve the same filter.
- Test filters, sort orders and page sizes supported by the API.
- Record account, tenant, request and expected record owners.
- Check a legitimate shared record as a positive control.
Check cursor context
Where permitted, supply an A-issued cursor in B's otherwise valid session and verify the server applies B's authorization. Do not assume that an opaque or signed cursor grants permission to the underlying records. Avoid modifying or guessing real customer cursors.
Retest all relevant list paths
After a fix, repeat the cross-account cursor case, normal iteration and count checks. Include export or search endpoints that reuse the same query and verify that legitimate pagination remains stable under the intended access policy.
Assessment limits
Pagination behavior can change with concurrent writes and ordering. A bounded fixture cannot establish every filter or export path; inspect coverage and document untested variants.
Frequently asked questions
Does an opaque cursor enforce tenant isolation?
Not by itself. The server must apply the current caller's authorization to each request and returned object.
Can a total count disclose information?
Yes. An unscoped count can reveal the existence or volume of records outside the caller's permitted view even when individual records are hidden.
Primary sources and further reading
These guides combine published security guidance with practical assessment planning. Adapt checks to the owner's policy, environment, and authorized scope.
This guide was prepared with AI assistance using the linked sources and illustrative examples. Check current vendor guidance and your environment before making changes.