Accept only the fields you expect

How to do it

List the fields each form or API may change. Ignore or reject the rest. Keep fields such as role, price and owner_id out of every list a user can reach.

Examples

JavaScript example

// Bad
await db.users.update(id, req.body);
// Good
const { name, phone } = req.body;
await db.users.update(id, { name, phone });

Python example

# Python: copy named fields only
changes = {field: body[field] for field in ("name", "phone") if field in body}
users.update(user_id, changes)

PHP example

// PHP with Laravel
$user->update($request->only(['name', 'phone']));

How to check

Update a test user's profile with an extra "role": "admin" field. The role stays the same.

Sources

• OWASP Mass Assignment Cheat Sheet

Related rules

• API-12 Accept only fields you know in API design
• API-13 Say which format PATCH accepts in API design
• API-50 Mark server-set fields read-only and secrets write-only in API design
• DSK-11 Check the sender and content of every message to the main process in Desktop apps and extensions