Mass assignment
A bug where an API saves every field from the request body, including ones the user must not change.
Definition
If the server copies the whole request body into the database, a user can add fields like "role": "admin" or "balance": 9999 to a normal profile update. Protected fields must be ignored or rejected. Test only on test environments with permission.
In practice
PATCH /users/me with {"name": "Ana", "role": "admin"} returns 200, and a follow-up GET shows role: admin.
Learn it in context
Lessons that use this term.