medium10 pts · first answer countssecurityapi-design

Saving req.body directly

What is the main problem with this "update my profile" endpoint?

app.patch('/me', auth, async (req, res) => {
  await db.user.update({ where: { id: req.user.id }, data: req.body })
  res.sendStatus(204)
})

A.It should return 200 instead of 204B.The auth middleware runs after the handler, so anonymous users can update the record whose id is undefinedC.Clients can set any column, such as {"role":"admin"}; validate and allowlist the fieldsD.The ORM cannot update a record by id

← Any user can read any invoice Testing code that calls a payment API →