https://crusaderproxy.com/research/en/tags/mass-assignment/ Recent content in Mass-Assignment on Crusader Research Hugo en-US Sun, 05 Jul 2026 00:00:00 +0000 https://crusaderproxy.com/research/en/posts/hidden-parameter-mining/ Sun, 05 Jul 2026 00:00:00 +0000 https://crusaderproxy.com/research/en/posts/hidden-parameter-mining/ <p>Every endpoint has two input surfaces: the parameters the client sends, and the parameters the server will bind <em>if you happen to name them</em>. The second surface never appears in your proxy history, never appears in the OpenAPI spec, and never gets a test written against it — which is exactly why the privilege flags and debug toggles live there. A framework binds request fields onto a model. The web and mobile clients populate six of them. The other four — <code>is_admin</code>, <code>debug</code>, <code>internal_notes</code>, <code>account_id</code> — are wired up, honored, and completely untested because nobody sends inputs they don&rsquo;t know exist.</p>