Direct answer
Mass assignment occurs when request fields are bound to object properties the caller should not be able to change. Test the actual persisted state, not merely whether an extra field is echoed in a response.
Model editable fields
With the owner, list fields an ordinary user can edit and fields reserved for administrators or server logic. A profile's display name may be editable while its account role and billing status are not. Create a disposable test account and avoid touching real permissions.
Reference: OWASP Mass Assignment Cheat Sheet.
Compare requests
Send a normal profile update and confirm it works. In a test environment, include one approved harmless sensitive-field candidate with a value that cannot grant real access. Compare both the response and a subsequent authorized read of the stored record.
- Test create and update separately.
- Check nested objects and alternate API versions when in scope.
- Record the expected policy and observed persisted value.
Assess the actual impact
An echoed field can be discarded before storage; an error may occur after another field has changed. Verify with a reliable read and review side effects. Avoid trying privileged roles, balances or ownership changes unless the fixtures and procedure have been specifically approved.
Retest field restrictions
After a fix, confirm an allowed field still changes and a prohibited field does not. Review dedicated input objects or allowlisted fields alongside object-level authorization, and repeat for background processing paths that reuse the input.
Assessment limits
A limited field list cannot prove all writable properties are protected. Mass assignment and object ownership are separate authorization decisions and both need coverage.
Frequently asked questions
Does an unexpected field in a response prove mass assignment?
No. Establish whether the server actually stored or acted on the value contrary to policy.
Does an input allowlist replace object authorization?
No. The caller must also be allowed to modify the particular record and operation.
Primary sources and further reading
These guides combine published security guidance with practical assessment planning. Adapt checks to the owner's policy, environment, and authorized scope.
This guide was prepared with AI assistance using the linked sources and illustrative examples. Check current vendor guidance and your environment before making changes.