Overposting

As explained in Secure APIs

Mass assignment is an object-binding behavior that maps multiple client-supplied fields directly onto an application's object or model.

Overposting, also called mass assignment, occurs when an API binds many client-supplied fields directly to an application object or database model. A client may then change fields reserved for server-controlled workflows. section 4.6.1

Changing a payment status

A payment API should accept an amount and currency, then manage statuses such as pending, accepted, settled, or rejected. If it constructs a payment from the entire request, a client can submit status: accepted and bypass the intended payment lifecycle. Sensitive fields can include order status, discounts, loyalty points, and access privileges. section 4.6.1

Prevent overposting by:

• Avoiding direct binding of unrestricted request data to database models, and testing inputs continuously for unauthorized field changes. section 1.8

Figure 4.6 A payment goes through a life cycle with stages such as pending, accepted, settled, and rejected. Those stages can be documented as an enumeration in an OpenAPI schema.

Use the payment lifecycle and its OpenAPI enumeration to distinguish client-settable payment data from server-controlled status transitions. section 4.6.1

How Secure APIs covers it

How deep it goes

Explains the failure mode, consequences, vulnerable and constrained implementations, but does not detail framework-specific internals.

Examples

Uses payment-status payloads, Ruby on Rails binding, and Python request schemas to demonstrate exploitation and prevention.

What it assumes

Assumes familiarity with API requests and models while introducing the vulnerability through a concrete payment example.

What you can do after

Diagnose unrestricted model binding and apply operation-specific request schemas that exclude server-controlled fields.

How it connects

Connects mass assignment with API security, input validation, payment workflows, OpenAPI schemas, and business logic integrity.

liveBookmanning.com

Read Secure APIs on liveBook Get the book at manning.com

Also explained in

• 

  liveBookmanning.com
  ASP.NET Core in Action, 3eOverposting is a security vulnerability in which client-supplied fields are bound directly to properties that the application did not intend to expose for modification.

Compare how 2 books explain overposting →

Related concepts

• protected attributesaddressed by · Protected attributes are model properties configured to reject direct assignment through a mass-assignment mechanism.
• validationaddressed by · The process of checking data, behavior, systems, models, or results against defined criteria to assess their correctness, suitability, or acceptability.
• sanitizationaddressed by · Sanitization is the process of checking, modifying, removing, or normalizing data to meet relevant safety, privacy, consistency, or domain requirements before use or sharing.
• secure by designused by · Secure by design is an engineering approach that incorporates security requirements and protections throughout a system’s design, development, and lifecycle.
• vulnerabilitykind of · A vulnerability is a weakness or susceptibility in a system, process, or person that can expose it to harm, misuse, failure, or compromise.

This explainer was generated by Manning's knowledge graph from the text of Secure APIs. The section links point to the parts of the book it draws on.