Web Security · Middle · Question 59 of 75

What is mass assignment?

1Updating many database rows in one query
2Assigning the same value to many variables
✓Correct answer: Binding the whole request body to a model, so a user can set fields like isAdmin or price they shouldn't control

Explanation

Accept only an allowlist of fields with a schema or DTO, and set sensitive fields on the server.

Further reading

Test yourself

Take the Web Security · Middle quiz: questions and options are shuffled, and you get a review of your mistakes at the end.