Mass Assignment Toy
A "update my profile" endpoint that binds whatever JSON you send straight to your account. Find the field that shouldn't be writable.
A convenience feature in most web frameworks binds incoming JSON straight onto an object. Send a field the form never showed — isAdmin, role, balance — and if the binding is not restricted, it is written anyway.
How to use it
- Update your profile normally and watch the request.
- Add a field the form does not send.
- Find the one that should not have been writable.
What to take away
The form is not the contract
Whatever the UI displays, the endpoint accepts whatever it accepts. The server must define the allowed fields explicitly.
Allowlist the writable fields
Binding everything and blocklisting the dangerous names fails as soon as someone adds a field and forgets the list.
Frequently asked questions
What is mass assignment also called?
Autobinding, or object injection. Rails documented it as mass assignment, and the name stuck across ecosystems.
How is it prevented?
Use an explicit input model — a DTO or serializer listing exactly the fields a client may set — and never bind a request body directly onto a persistence object.
Where this fits in the course
This security lab pairs with Path 21 — API Security — see all 26 learning paths.
It runs entirely in your browser: nothing is uploaded, no account is needed, and it is free.
Related
- BOLA/BFLA Playground — A fake employee-directory API. Read a record that isn't yours, then call an admin-only action with no admin role at all.
- IDOR Playground — A fake "my invoices" page. Change one number in the URL and see whose data you were never supposed to see.
- Insecure Deserialization Toy — A "remember me" cookie is a trusted, deserialized object. Add one field to grant yourself admin with zero login.
- GraphQL Introspection Abuse — A single /graphql endpoint. Use introspection to map the full schema, then query a field the UI never shows you.