ASP.NET Core Web API Interview Question #193

How should an API protect against mass assignment or overposting?

Senior API Design, Architecture, Scalability & Production Scenarios Senior Advanced

Quick Interview Answer

Accept purpose-specific request DTOs containing only fields the client is allowed to control. Map those fields explicitly to domain entities rather than binding persistence entities directly.

Detailed Explanation

Accept purpose-specific request DTOs containing only fields the client is allowed to control. Map those fields explicitly to domain entities rather than binding persistence entities directly.

Authorization must still protect sensitive operations. DTOs prevent accidental field binding, but they do not decide whether the current user is permitted to perform the requested change.

Code Example

public sealed class UpdateUserProfileRequest
{
    public string DisplayName { get; init; } = "";
}

// IsAdmin, TenantId, Balance, etc. are not client-writable.
user.DisplayName = request.DisplayName;