Mass assignment
An API copies request fields straight into an object, so a caller can set properties they should not, such as a role or a price (CWE-915, part of OWASP API3:2023).
- Also called
- autobinding · over-posting
- Fix it in your stack
- Mass assignment (over-posting) fix cards (10 stacks) · CWE-915 page
- Defined in
- MITRE CWE-915
Covered in
Authorize functions and fields as well as objects
Prevent mass assignment, sensitive-field exposure and administrative actions that a valid object lookup alone cannot protect.
Case study: Spring4Shell (CVE-2022-22965)
How Spring's data binding let request parameters reach the class loader on JDK 9 and later in 2022, why the denylist workaround leaked, and what it teaches about framework-level mass assignment.
Keep untrusted object keys out of prototype and authority paths
Trace an actual nested-merge mutation, replace it with a narrow schema, and make authorization independent of inherited properties.
Abuse case library: tests and controls by feature
Recurring abuse cases for sign-up and login, password reset, MFA enrolment, invites, file upload, payments and coupons, webhooks, search, export, admin and AI chat or agents: the attacker goal, preconditions, a concrete test and the control, each linked to CWE and CAPEC.
Authorization models: RBAC, ABAC, ReBAC and policy as code you can test
Translate roles, attributes and relationships into explicit subject-action-resource decisions, prevent broken object level authorization (BOLA), and verify ownership and tenant boundaries with tests.
Threat pattern library for threat modeling
Thirty-two recurring threat patterns grouped by identity, authorization, parsers, concurrency, integrations, data exposure, supply chain, availability and AI agents, each with where it shows up on a data-flow diagram, mitigations, a verification step and STRIDE, CWE and CAPEC links, plus a YAML catalog and a script that lists patterns per diagram element.
Practice: Mass assignment lab: Update only the fields users may edit · Local project: Secure a real HTTP API · Local project: Stop prototype pollution at merge and authorization boundaries