API Hacking: Mass Assignment and Excess Data Exposure

Mass assignment and excess data exposure are two sides of sloppy boundary setting. One lets clients write fields they shouldn't; the other sends back fields the UI never needed.

They're not glamorous, but they're everywhere in rapid API development—especially when ORMs map JSON straight to models.

Mass assignment in the wild

Admin flags, discount fields, and ownership IDs tucked into update payloads. Partial update endpoints (`PATCH`) are frequent offenders when servers merge objects without allowlists.

Mobile apps often reveal writable field names in their bundled configs.

Excess exposure patterns

List endpoints return full user objects when the UI only shows names. Internal metadata—stripe IDs, verification scores—rides along silently.

Version bumps sometimes add fields without updating response filters.

Testing mindset on scoped apps

Compare API responses across roles for field differences. Note create/update schemas versus what the frontend sends.

• Document fields that should never be client-controlled

• Check batch import and CSV endpoints

• Review error messages for schema hints

Remediation that sticks

DTOs with explicit allowlists, response serializers per role, and contract tests when schemas change. OpenAPI can document intended shapes if teams enforce it in CI.

These bugs reward careful diffing more than clever gadgets.

Stay within authorized accounts and program rules when comparing role responses.

Versioning and mobile lag

API v2 might filter responses while v1 still returns legacy fields mobile clients depend on—test all advertised versions in scope.

Import endpoints and admin CSV uploads are mass-assignment magnets because they map columns to models without role awareness.

Admin vs user serializers

Split serializers by role at the framework level—one giant model serializer is how mass assignment returns.

GraphQL field-level auth must match REST field filtering or mobile clients will pick the leakier API.

Recommend negative tests in CI: ensure forbidden fields rejected on create/update payloads.

---

Worth reading next

API Hacking: Broken Object Level Authorization (BOLA)

API Hacking: Swagger and OpenAPI Recon

Information Disclosure: The Quiet Vulnerability Class