Context#
PATCH is not uniform across frameworks: JSON Merge Patch, custom shallow merge, and null to delete semantics differ. A client can intend to change name while the merge overwrites balance or role if those keys are accepted in the merge input object.
Theory#
The same mass-assignment class appears when the operation is “partial” but the object shape is the full model. null and absent key often mean different things; attackers probe both.
Practice#
Send full document shape with one extra sensitive key#
- In a lab, take a
GETof the object, copy the JSON, add acreditLimitorstatuskey that should be server-only, andPATCHit. Compare the nextGET.
Tools#
- curl
- Burp Suite