Allowlists for Responses
Explicit serializers beat “return the ORM entity.”
Visual · api_allowlists
Allowlists both ways: input and output. Original Cyberlium.
If you can name the field, you can decide if it ships.
Pair mass-assignment allowlists with response allowlists. Document public fields. Test that privileged fields never appear.
1. Input vs output allowlists
Input: writable fields. Output: visible fields. Different lists.
Admin DTOs may include more — still authenticated and authorized.
Command guide
Try these commands — Input vs output allowlists
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
Allowlist pattern — https://cheatsheetseries.owasp.org/cheatsheets/Mass_Assignment_Cheat_Sheet.html JSON Patch — https://datatracker.ietf.org/doc/html/rfc6902
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install curl sudo apt install jq
macOS:
Command — copy this
brew install jq
Windows: Built-in (PowerShell: Invoke-WebRequest)
Command — copy this
choco install jq
═══ LINUX / macOS ═══
Command — copy this
curl -sS -X PATCH http://127.0.0.1:8816/profile -H "Content-Type: application/json" -H "Authorization: Bearer userA" -d '{"theme":"dark"}' | jq '.theme // .'
curl -sS -o /dev/null -w "forbidden field %{http_code}
" -X PATCH http://127.0.0.1:8816/profile -H "Content-Type: application/json" -H "Authorization: Bearer userA" -d '{"isAdmin":true}'Primary tools to practice this lesson: curl, jq. Reference sites: Allowlist pattern (https://cheatsheetseries.owasp.org/cheatsheets/Mass_Assignment_Cheat_Sheet.html); JSON Patch (https://datatracker.ietf.org/doc/html/rfc6902). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Tests
Assert passwordHash not in JSON. Assert role not settable by user.
Automate in CI for YOUR services.
3. Documentation
OpenAPI can document schemas — keep them accurate.
Do not publish internal-only fields in public docs accidentally.
4. What you ship: twin allowlists
Input + output field lists. Tests named.
5. What you record before the next lesson
Two lists in notes.
6. Wrong vs right: stranger APIs vs literacy on systems you own
Worked failure — same API word, opposite target. Right never needs a live shop or classmate token.
- Wrong: Document internal debug fields in public OpenAPI.
- Right: Write lists. Next: exposure lab.
Mission: twin allowlists
1) Write input allowlist. 2) Write output allowlist. 3) Write one automated assertion idea.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “Why input and output lists differ?”
APPLY: Output allowlist controls:
APPLY: True or False: Same list always for input and output.
APPLY: Assert in tests: