ASP.NET Core Web API Interview Question #34

What is overposting in a Web API?

DTOs, Model Binding, Validation & API Responses Junior Beginner

Quick Interview Answer

Overposting occurs when a client can submit properties that the operation did not intend to let the client control. Binding persistence entities directly is a common cause because fields such as IsApproved, OwnerId, or IsAdmin may become writable unintentionally.

Detailed Explanation

Overposting occurs when a client can submit properties that the operation did not intend to let the client control. Binding persistence entities directly is a common cause because fields such as IsApproved, OwnerId, or IsAdmin may become writable unintentionally.

Use purpose-specific request DTOs and explicitly map approved fields on the server.

Code Example

public sealed class ProfileUpdateRequest
{
    public string DisplayName { get; init; } = "";
}

// Do not accept IsAdmin or protected account fields
// from the request payload.