domains / families / security / testing-api-for-mass-assignment-vulnerability

testing-api-for-mass-assignment-vulnerability

separate

'Tests APIs for mass assignment (auto-binding), OWASP API3:2023, by identifying

When to use

• Testing API endpoints that accept JSON/XML request bodies for user profile updates, registration, or object creation
• Assessing whether the API binds all client-supplied properties to the data model without an allowlist
• Evaluating if users can set privileged attributes (role, permissions, pricing, balance) through regular update endpoints
• Testing APIs built with ORMs that auto-bind request parameters to database models
• Validating that server-side input validation restricts writeable properties per user role

When not to use

• Use without written authorization

Skill page

Source