Mass assignment protection in Laravel - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ component_behavior

intermediate

What happens when mass assignment is used without protection?

Consider a Laravel model with no $fillable or $guarded properties defined. What will happen if you try to create a new model instance using mass assignment with request data?

Laravel

User::create($request->all());

A Only attributes defined in the database schema will be saved, others ignored silently.

B Laravel will throw a MassAssignmentException error preventing the creation.

C The model will be created with all attributes from the request, potentially including sensitive fields.

D The model will be created but all attributes will be set to null.

💡 Hint

Think about what happens if you don't specify which fields are allowed for mass assignment.

By default, Laravel sets $guarded = ['*'] if neither $fillable nor $guarded is explicitly defined on the model. This guards all attributes and throws a MassAssignmentException when attempting mass assignment.

📝 Syntax

intermediate

Which code correctly protects against mass assignment?

Given a Laravel model, which of the following correctly protects the model from mass assignment vulnerabilities?

Laravel

class Post extends Model {
    // protection here
}

A protected $guarded = [];

B protected $guarded = ['title', 'content'];

C protected $fillable = ['*'];

D protected $fillable = ['title', 'content'];

💡 Hint

Remember, $fillable defines allowed fields, $guarded defines disallowed fields.

Setting $fillable to an array of allowed fields explicitly permits only those fields for mass assignment, protecting the model.

🔧 Debug

advanced

Why does this mass assignment fail with MassAssignmentException?

Given this model and controller code, why does the mass assignment fail?

Laravel

class Product extends Model {
    protected $guarded = ['id'];
}

// In controller
Product::create(['id' => 5, 'name' => 'Book', 'price' => 10]);

A Because 'id' is guarded, but it is included in the create array, causing the exception.

B Because 'name' and 'price' are not in $fillable, mass assignment is blocked.

C Because $guarded should be empty to allow mass assignment.

D Because the model is missing a $fillable property, mass assignment always fails.

💡 Hint

Check which fields are guarded and what is being assigned.

The 'id' field is guarded, so including it in mass assignment causes Laravel to throw a MassAssignmentException.

❓ state_output

advanced

What is the value of $user->admin after mass assignment?

Given this User model and code, what will be the value of $user->admin after creation?

Laravel

class User extends Model {
    protected $fillable = ['name', 'email'];
}

$user = User::create(['name' => 'Alice', 'email' => '[e-mail]', 'admin' => true]);

A true

B false

C null

D Throws MassAssignmentException

💡 Hint

Check which fields are allowed in $fillable and what happens to others.

Since 'admin' is not in $fillable, it is ignored during mass assignment and remains null.

🧠 Conceptual

expert

Why is mass assignment protection important in Laravel?

Which of the following best explains why Laravel uses mass assignment protection?

A To prevent users from setting sensitive model attributes they should not control, avoiding security risks.

B To improve database query performance by limiting fields.

C To automatically validate user input before saving to the database.

D To allow mass assignment only for admin users.

💡 Hint

Think about what could happen if users could set any attribute freely.

Mass assignment protection prevents users from setting sensitive fields like 'is_admin' or 'balance' which could lead to security breaches.

Practice

1. What is the main purpose of mass assignment protection in Laravel?

easy

A. To speed up database queries automatically

B. To control which model attributes can be set in bulk

C. To encrypt user passwords before saving

D. To generate database migrations

Solution

1. Step 1: Understand mass assignment concept

   Mass assignment means setting multiple model attributes at once, often from user input.

2. Step 2: Identify protection purpose

   Mass assignment protection controls which attributes can be set this way to prevent unwanted changes.

3. Final Answer:

   To control which model attributes can be set in bulk -> Option B

4. Quick Check:

   Mass assignment protection = control allowed fields [OK]

Hint: Mass assignment protects fields from unwanted bulk changes [OK]

Common Mistakes:

• Confusing mass assignment with password encryption
• Thinking it speeds up queries
• Believing it creates migrations automatically

2. Which of the following is the correct way to allow mass assignment for the 'name' and 'email' fields in a Laravel model?

easy

A. public $fillable = ['name', 'email'];

B. protected $guarded = ['name', 'email'];

C. protected $fillable = ['name', 'email'];

D. public $guarded = ['name', 'email'];

Solution

1. Step 1: Recall correct property for allowed fields

   In Laravel, $fillable lists fields allowed for mass assignment.

2. Step 2: Check syntax and visibility

   The property should be protected and named $fillable with an array of allowed fields.

3. Final Answer:

   protected $fillable = ['name', 'email']; -> Option C

4. Quick Check:

   $fillable = allowed fields [OK]

Hint: Use $fillable to list allowed fields, not $guarded [OK]

Common Mistakes:

• Using $guarded to allow fields instead of block
• Making $fillable public instead of protected
• Confusing $fillable and $guarded names

3. Given the model below, what will happen if you try to create a user with User::create(['name' => 'Anna', 'email' => '[e-mail]', 'role' => 'admin']);?

class User extends Model {
    protected $fillable = ['name', 'email'];
}

medium

A. Error thrown because role is not fillable

B. User is created with all fields including role

C. User is created but name and email are empty

D. User is created with name and email set; role is ignored

Solution

1. Step 1: Check $fillable fields

   The model allows mass assignment only for 'name' and 'email'.

2. Step 2: Understand behavior for unfillable fields

   The 'role' field is ignored during mass assignment, no error is thrown.

3. Final Answer:

   User is created with name and email set; role is ignored -> Option D

4. Quick Check:

   Only $fillable fields set, others ignored [OK]

Hint: Only $fillable fields are set; others ignored silently [OK]

Common Mistakes:

• Expecting an error for unfillable fields
• Thinking all fields are set regardless of $fillable
• Assuming unfillable fields become null

4. You have this model:

class Post extends Model {
    protected $guarded = [];
}

You want to prevent mass assignment on the 'is_admin' field. What is the best fix?

medium

A. Add 'is_admin' to the $guarded array

B. Set $guarded = ['*'] to block all fields

C. Remove the $guarded property completely

D. Add 'is_admin' to the $fillable array

Solution

1. Step 1: Understand current $guarded setting

   Currently, $guarded is empty array, so all fields are mass assignable.

2. Step 2: Block 'is_admin' field

   To block a field, add it to $guarded array to prevent mass assignment.

3. Final Answer:

   Add 'is_admin' to the $guarded array -> Option A

4. Quick Check:

   $guarded blocks fields; add 'is_admin' there [OK]

Hint: Add fields to $guarded to block mass assignment [OK]

Common Mistakes:

• Adding blocked fields to $fillable instead
• Removing $guarded and expecting protection
• Blocking all fields unintentionally with ['*']

5. You want to allow mass assignment on all fields except 'password' and 'is_admin' in a Laravel model. Which is the best way to do this?

hard

A. protected $guarded = ['password', 'is_admin'];

B. protected $fillable = ['password', 'is_admin'];

C. protected $fillable = ['*'];

D. protected $guarded = [];

Solution

1. Step 1: Understand the goal

   Allow all fields except 'password' and 'is_admin' for mass assignment.

2. Step 2: Choose correct property

   Using $guarded to block specific fields is best for this case.

3. Step 3: Evaluate options

   Setting protected $guarded = ['password', 'is_admin']; blocks those fields and allows others.

4. Final Answer:

   protected $guarded = ['password', 'is_admin']; -> Option A

5. Quick Check:

   $guarded blocks fields; use it to exclude only some [OK]

Hint: Use $guarded to block few fields, allow all others [OK]

Common Mistakes:

• Using $fillable with only blocked fields (wrong meaning)
• Setting $fillable to ['*'] which is invalid
• Leaving $guarded empty and expecting protection