The form is not the contract
NovaCart's registration page asks you for an email address and a
password. That is what the form collects — but the form is not the
API contract. Behind the page, the browser sends a JSON request to
POST /api/Users, and the server decides what to do with every field it
finds in that request body.
In this lesson you will see what happens when the server is too trusting.
The User record has a role field that the form never shows you and that
defaults to customer. If the registration endpoint binds the whole request
body onto the user object without checking which fields are allowed, you can
simply add a role field yourself and the server will store it. This is
mass assignment: the client assigning fields the application never meant
to expose.
You will:
- Capture the real registration request and read its fields.
- Understand why an extra field you add is accepted and persisted.
- Craft a request body that promotes the new account to
admin. - Learn why hiding the field in the UI fixes nothing — and what does.
Reminder: the bundled NovaCart application instance is your authorized lab. Practice
these techniques only against targets you own or are explicitly permitted
to test.