Fix Mass Assignment in Spring WebFlux

Mass Assignment in Spring WebFlux is a high-impact vulnerability where an attacker manipulates the internal state of an application by injecting unexpected parameters into a request. This happens when the framework blindly binds JSON payloads to domain entities or internal POJOs. If your controller accepts a database entity as a @RequestBody, you are essentially allowing clients to write directly to your schema, potentially escalating privileges or modifying sensitive fields like 'isAdmin' or 'accountBalance'.

The Vulnerable Pattern

@PostMapping("/api/profile")
public Mono updateProfile(@RequestBody UserEntity user) {
    // VULNERABLE: The 'user' object is a JPA/R2DBC entity.
    // An attacker can send {"role": "ADMIN", "id": 1} to overwrite protected fields.
    return userRepository.save(user);
}

The Secure Implementation

To kill Mass Assignment, you must decouple your API contract from your data model. Use Data Transfer Objects (DTOs) or Java Records to define exactly which fields are mutable by the user. By binding the @RequestBody to a DTO instead of a domain entity, any extra fields sent by an attacker (like 'permissions' or 'balance') are ignored during deserialization. The secure implementation fetches the existing record from the database and manually updates only the whitelisted fields from the DTO before persisting.

public record ProfileRequest(String bio, String displayName) {}
@PostMapping(“/api/profile”)
public Mono updateProfile(@RequestBody ProfileRequest dto, Authentication auth) {
return userRepository.findById(auth.getName())
.flatMap(existingUser -> {
// SECURE: Explicitly mapping only allowed fields (Whitelisting)
existingUser.setBio(dto.bio());
existingUser.setDisplayName(dto.displayName());
return userRepository.save(existingUser);
});
}