What is Overposting / Mass Assignment in ASP.NET Core, and how do you prevent it?

Short answer

It happens when a Controller accepts an internal entity directly as an Action parameter, letting a client set sensitive fields; use purpose-specific DTOs for each request.

Explanation

If an Action accepts public IActionResult Update(User user), an attacker can send IsAdmin: true in the JSON and the Model Binder may assign it to the entity and save it. The strict rule is never to use EF Core Entities as API parameters; use Request DTOs containing only the fields that the user is allowed to change.

Code example

// DTO Secure and limited to what the user is authorized to modify
public record UpdateProfileRequest(string DisplayName, string Bio);

[HttpPut("profile")]
public async Task<IActionResult> Update(UpdateProfileRequest request) { ... }

Common mistakes

• Relying on the old [Bind] Attribute in Controllers instead of explicitly separating DTOs.

Follow-up questions

• How do ASP.NET Core view engines and Controllers protect an application against Cross-Site Scripting (XSS)?

Sources

• Microsoft Learn — Prevent overposting in ASP.NET Core