Glossary term
What is mass assignment? Meaning for developers
In Backend in Depth
A bug where a client sets fields it should not (like isAdmin) because the server saves the whole request body into the database.
Learn it properly · Backend in DepthLesson 3: Validation at the Edge: Schemas, DTOs and Trusting NothingCheck input where it enters the API, share schemas with the frontend, and keep validation errors apart from business-rule errors.In Security for Developers
A bug where the server copies every field of the request body into a record, so a user can set fields like role or plan that they should never control.
Learn it properly · Security for DevelopersLesson 4: Access Control: IDOR, Roles and Mass AssignmentThe number one web risk: checking who you are but not what you may do. IDOR with a real example, deny by default, roles and ownership checks, and mass assignment.In API Design
A bug where the server copies every field a client sent into the database, letting the client set fields like role.
Learn it properly · API DesignLesson 2: Request and Response Design: JSON Shapes, Errors and ValidationConsistent JSON, naming, dates and money, one error format (RFC 9457 problem details), validation with clear messages, and what never to return.