DEV Community

Matthias Biehl
Matthias Biehl

Posted on • Updated on • Originally published at api-university.com

The 10 most critical API security risks - Part 6: Mass Assignment

The recently published “OWASP API security top 10” report analyzes the anti-patterns that lead to vulnerabilities and security risks in APIs. In this 10 part series, we introduce these API anti-patterns. Every API professional should know about these anti-patterns.


Mass Assignment from the OWASP API security paper

API security anti-pattern for Mass Assignment

The binding of client-provided data (e.g., JSON) to data models, without properties filtering based on a whitelist, usually leads to Mass Assignment. Either guessing objects properties, exploring other API endpoints, reading the documentation, or providing additional object properties in request payloads, allows attackers to modify object properties they are not supposed to.

Want to learn more?

Check out the complete OWASP API security paper. To secure access to your APIs, learn more about the OAuth in the OAuth Book, or the OAuth Course. To provide and use identity data in apps and APIs, learn more about OpenID Connect in the OpenID Connect Book, or the OpenID Connect Course.

Top comments (0)