6 Ways To Avoid Mass Assignment in ASP.NET MVC
Posted by: K. Scott Allen,
on 12 Mar 2012 |
View original | Bookmarked: 0 time(s)
One of the scenarios that I always demonstrate during an ASP.NET MVC class is how to create a mass assignment vulnerability and then execute an over-posting attack. It is a mass assignment vulnerability that led to a severe problem on github last week. Let's say you have the following model. public class User
{
public string FirstName { get; set; }
public bool IsAdmin { get; set; }
}
When you want to let a regular user change their first name, you give them the following form.
@using...