Block Sensitive Field Mass Assignment

A generic update handler may copy every JSON property into a database model. That makes a client-provided owner, role, price, or approval flag a security decision. The API can check access to the object and still let the caller change protected fields. OWASP API Security Top 10 covers this property-level write risk.

Define the input contract

For one create or patch endpoint, list fields the caller may set, fields the server derives, and fields that require a separate privileged action.

Do not rely on a hidden form field or UI restriction. Parse input against the allowlist before calling the persistence layer. Decide whether unknown fields cause a clear error or are ignored. Test that choice, because silent acceptance can hide a later regression.

Verify state, not only status

Use a synthetic record. Send an allowed change and confirm it works. Then include one protected field at a time in a controlled test. Check the stored row, audit event, queued jobs, and response. A request may return an error after a side effect has already occurred. Include create and update paths, since they often have different validators.

The OWASP ASVS provides a verification frame for input and access controls. This allowlist table is the local artifact that names the product's protected fields. Revisit it when the data model gains a new property. If a field needs a real user workflow, design that workflow with its own authorization and evidence instead of placing it in a generic update endpoint. Do not send these tests to an external API without written scope.