Authorization
Protect object properties
Allowlist fields callers may read or change so mass assignment and excessive data exposure cannot cross property-level permissions.
8 minute lesson
A user may access an object without being allowed to see or edit every property on it.
Parse request bodies into purpose-specific input types. Do not spread arbitrary JSON into a database update. Build response objects from approved fields and apply role-specific views where necessary.
A customer may change an invoice label but not isPaid or accountId. Silently ignoring forbidden fields can preserve compatibility, while rejecting them makes client mistakes easier to detect.
Choose one behavior and document it in the contract. The important evidence is the stored row and returned object, because a successful status alone can hide a partial unauthorized update.
Send an update containing one allowed field and two protected fields. Prove the allowed value changed, the protected values did not, and the response never reveals internalNote.
Lesson completed