Advanced Web, API & Modern Stack
Mass Assignment — Concept + Live Lab
Set fields the form never showed — like role:admin — to escalate.
Open the interactive lesson & lab →
Mass assignment (a.k.a. auto-binding / object injection) happens when a framework maps request fields straight onto an internal object. If the object has sensitive fields the form doesn't show (role, isAdmin, verified, balance), you can set them by simply adding them to the request.
// The form sends: { "name": "You", "email": "..." }
// You send: { "name": "You", "email": "...", "role": "admin" }If the server does user = { ...user, ...body } with no allowlist, you're now admin. This is extremely common in Rails, Node/Express, Laravel, and Spring apps that bind request bodies to models.