Protected attributes are model properties that reject direct assignment through mass assignment. They prevent user-controlled payloads from binding sensitive fields to database objects. section 4.6.1
Preventing privilege changes
A signup endpoint that binds every submitted field could accept user[admin]=1 and create an administrator profile. Constrain input to permitted fields, such as amount and currency, while setting status and other protected properties separately. section 4.6.1
Check mass-assignment defenses by asking:
- Can a request override status, role, ownership, or another field the user should not control? section 4.6.1
- Does the endpoint validate and sanitize input before binding it to a database model? section 4.6.1
Figure 4.7 Mass assignment happens when a threat actor manages to override a field they shouldn’t be able to access, such as the status of a payment.
Use the payment-status illustration to recognize mass assignment as unauthorized overriding of a protected field. section 4.6.1
