Accept only the fields you expect

How to do it

List the fields each form or API may change. Ignore or reject the rest. Keep fields such as role, price and owner_id out of every list a user can reach.

Example

// Bad
await db.users.update(id, req.body);
// Good
const { name, phone } = req.body;
await db.users.update(id, { name, phone });

# Python: copy named fields only
changes = {field: body[field] for field in ("name", "phone") if field in body}
users.update(user_id, changes)

// PHP with Laravel
$user->update($request->only(['name', 'phone']));

How to check

Update a test user's profile with an extra "role": "admin" field. The role stays the same.