Which item is a principle of improper access control listed in 6.5.8?

• A. Not exposing internal object references to users
• B. Exposing internal object references to users
• C. Allowing access to unauthorized functions
• D. Storing internal references in logs

Answer: (A)

Not exposing internal object references to users is about preventing leakage of implementation details that could be exploited to bypass security. When an application reveals internal IDs, object handles, file paths, or other references in URLs, error messages, or responses, an attacker can guess or manipulate those references to access other resources. By using opaque, server-side mappings (tokens) and enforcing authorization checks for every request, you keep the internal structure hidden and ensure access decisions are made securely on the server.

This principle directly counters improper access control, because exposing internal references gives attackers a blueprint of how the system is built and how to reach other data. The other options either describe actions that would enable unauthorized access (exposing internal references is the security risk itself) or describe related risks (storing internal references in logs can be risky but is not the specific principle about avoid exposing those references to users).