Fix Mass Assignment in Feathers

Mass assignment in FeathersJS occurs when service methods like 'create' or 'patch' blindly persist the entire 'data' object from the client. Without explicit filtering, an attacker can inject sensitive fields—such as 'role: admin' or 'balance: 9999'—into the request body, bypassing business logic and escalating privileges. In Feathers, the service layer is the frontline; if you don't sanitize 'context.data' in the 'before' hooks, you're pwned.

The Vulnerable Pattern

// users.hooks.js
module.exports = {
  before: {
    create: [], // VULNERABLE: Accepts any JSON payload
    patch: []   // VULNERABLE: Allows modification of any field
  }
};

The Secure Implementation

To kill mass assignment, you must implement field filtering in the 'before' hooks of your services. The 'keep' hook acts as a whitelist, ensuring only specified keys remain in 'context.data'. The 'discard' hook acts as a blacklist, stripping specific sensitive keys. For high-security entities like Users, always prefer 'keep' (whitelisting) to prevent 'fail-open' scenarios where new database columns are automatically exposed to the API.

// users.hooks.js
const { discard, keep } = require('feathers-hooks-common');
module.exports = {
before: {
create: [
// Strict Whitelisting: Only allow these fields to reach the DB
keep(‘email’, ‘password’, ‘username’)
],
patch: [
// Blacklisting: Prevent modification of sensitive attributes
discard(‘isAdmin’, ‘role’, ‘permissions’, ‘internalId’)
]
}
};