Mass Assignment
Client sends role=admin — server must ignore. Lab :8816.
Visual · api_mass_assignment
Mass assignment is over-binding client fields. Original Cyberlium.
If the server binds every JSON key, clients invent privileges.
Mass assignment happens when frameworks auto-bind request fields into models, including privileged ones. Allowlist writable fields. Demo on YOUR lab only.
1. The bug
PATCH /profile {"displayName":"A","role":"admin"} succeeds for role → broken.
Fix: allowlist displayName; ignore/reject role.
Command guide
Try these commands — The bug
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
Mass assignment — https://cheatsheetseries.owasp.org/cheatsheets/Mass_Assignment_Cheat_Sheet.html OWASP API3 — https://owasp.org/API-Security/editions/2023/en/0xa3-broken-object-property-level-authorization/
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install curl
macOS: Built-in
Windows: Built-in (PowerShell: Invoke-WebRequest)
═══ LINUX / macOS ═══
Command — copy this
curl -sS -X PATCH http://127.0.0.1:8816/profile -H "Content-Type: application/json" -H "Authorization: Bearer userA" -d '{"displayName":"LabUser"}'
curl -sS -o /dev/null -w "role escalation attempt %{http_code}
" -X PATCH http://127.0.0.1:8816/profile -H "Content-Type: application/json" -H "Authorization: Bearer userA" -d '{"role":"admin"}'Primary tools to practice this lesson: curl. Reference sites: Mass assignment (https://cheatsheetseries.owasp.org/cheatsheets/Mass_Assignment_Cheat_Sheet.html); OWASP API3 (https://owasp.org/API-Security/editions/2023/en/0xa3-broken-object-property-level-authorization/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Framework footguns
Some ORMs/binders default to permissive binding. Configure explicitly.
DTOs for input differ from DB entities.
3. Lab contrast
Allowed field updates. Privileged field rejected.
No attacks on stranger apps.
4. What you ship: allowlist sentence
Allowlist writable fields. Reject privilege keys.
5. What you record before the next lesson
Lab status for role=admin attempt.
6. Wrong vs right: stranger APIs vs literacy on systems you own
Worked failure — same API word, opposite target. Right never needs a live shop or classmate token.
- Wrong: POST isAdmin=true at a live admin API you do not own.
- Right: Lab contrast. Next: excessive exposure.
Mission: mass assignment contrast
1) PATCH allowed field. 2) PATCH role/admin (expect deny). 3) Write allowlist fix.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “Input DTO vs entity?”
APPLY: Mass assignment fix:
APPLY: True or False: Bind every JSON key by default.
APPLY: role in client JSON should be:
Excessive Data Exposure
Part of API Security with AI — Mass Assignment and Data Exposure.
Allowlists for Responses
Part of API Security with AI — Mass Assignment and Data Exposure.
Exposure Lab — Overpost and Overshare
Part of API Security with AI — Mass Assignment and Data Exposure.