Mass Assignment & Over-Posting¶

A subtle, dangerous bug: blindly spreading the request body into your database write.

The Vulnerable Code¶

1const body = await req.json();
2await prisma.user.update({ where: { id }, data: body }); // 😱

A user submits:

1{ "name": "Mallory", "role": "ADMIN", "isVerified": true }

They just promoted themselves to admin. This is mass assignment (a.k.a. over-posting): the client sets fields they were never supposed to touch.

Fix 1: Whitelist Fields with a Schema¶

1const UpdateProfile = z.object({
2  name: z.string().max(100).optional(),
3  bio:  z.string().max(500).optional(),
4}); // role, isVerified, id simply aren't here
5
6const data = UpdateProfile.parse(body);
7await prisma.user.update({ where: { id }, data });

Unknown fields are dropped. role can never be set through this endpoint.

Fix 2: Pick Explicitly¶

1const { name, bio } = body;
2await prisma.user.update({ where: { id }, data: { name, bio } });

Server-Controlled Fields Stay Server-Side¶

Some fields must never come from the client:

The rule from Chapter 5 generalizes: derive identity and privilege fields on the server, never from the request body.