Skip to content
Free public beta until December 4, 2026: every course is open, no card needed. After that, the first chapter of each course stays free and full access is a one-time $39 ($19 for up to 100 founding members chosen for helpful feedback). Your progress is kept. How the beta works

over-posting

When a client sets fields it shouldn't, because the API bound its input straight onto an entity.

Over-posting (mass assignment) occurs when request data binds to properties the client shouldn't control; input DTOs prevent it.

Examples

  • A client adds "isAdmin": true to a sign-up request that the API binds straight onto its User entity.

See also

DTO untrusted input
Read the full section →