Mass assignment
On This Lesson 4 topics
This lesson is planned. The outline below lists the topics it will cover. The full lesson has not been published yet.
In this lesson
avoid letting clients set fields they should not.
Planned topics
- Mass assignment: binding a request body straight onto an entity lets clients set fields like
role,price, orenabled. - Attack: send
{"name":"Ana","role":"ADMIN"}to the registration endpoint. - Fix: bind requests to a separate DTO with only the allowed fields.
- Copy fields explicitly into the entity.
- Entities are for the database; DTOs are for the API.
Draft outline details
Demonstration
RegisterRequest(email, password) DTO versus an entity with a role field.
Check your understanding
Why not bind the request body to the entity?
Show answer
A client could set fields such as role that it should not control.
Practice
Apply this lesson with the module's lab, exercises and quiz.
Marking a lesson complete is optional and you can undo it any time. Your progress stays in this browser.