Intermediate LevelWeb Security & Cyber Defense
How do Data Transfer Objects (DTOs) and strict property whitelisting neutralize Mass Assignment?
❓ Interview Prompt: Explain Mass Assignment vulnerability, class-transformer / class-validator DTOs, stripping un-whitelisted JSON properties, and ORM safety.
Mass Assignment occurs when an API framework automatically binds client JSON parameters directly to internal model properties:
Attack Payload:
Submitting '{ "username": "alice", "isAdmin": true, "balance": 999999 }' on a profile update form.
•
Defense with DTOs: Define explicit Data Transfer Object classes with strict validation decorators (e.g. 'class-validator' in NestJS). Configure 'whitelist: true' to automatically strip un-whitelisted properties!
Code Implementation Example
typescript
import { IsString, IsOptional } from 'class-validator';
export class UpdateProfileDto {
@IsString()
@IsOptional()
firstName?: string;
@IsString()
@IsOptional()
bio?: string;
// 'isAdmin' is omitted from DTO definition and automatically stripped!
}💡NestJS DTO class defining whitelisted profile properties.
🎯 Interview Key Takeaway
Use typed DTOs with property whitelisting to strip unexpected client JSON parameters before ORM binding.
#Mass Assignment#DTO#Validation#Intermediate
Back to all Web Security & Cyber Defense Questions→