What is Mass Assignment, and how do $fillable and $guarded differ in Eloquent?

Short answer

It occurs when a developer passes $request->all() directly to create(), allowing users to change sensitive fields such as is_admin; $fillable prevents this by restricting updates to an allowlist.

Explanation

Mass Assignment makes it convenient to write User::create($request->all()). If the class is not protected, an attacker can add 'is_admin': 1 to the request and immediately become an administrator. $fillable enforces a White-list, allowing only explicitly named fields, while $guarded specifies a blacklist of prohibited fields.

Code example

class User extends Model {
    protected $fillable = ['name', 'email', 'password'];
    // Any other field such as is_admin will be completely ignored
}

Common mistakes

• Setting protected $guarded = [] on every model as a shortcut, unknowingly exposing the application to serious security problems.

Follow-up questions

• How do Gates and Policies differ in Laravel authorization?

Sources

• Laravel docs — Mass Assignment