User update mass assignment

Code reviewSecuritySenior–Staff~20 min

Review this Express handler that updates a user profile.

What a strong answer looks like

Separate real bugs from style. Rank issues by severity, point at the root cause rather than the symptom, and suggest a concrete fix, specific and kind.

0:00 of about 20 min

Mark a line and say what kind of problem it is.0 findings

1app.patch('/api/users/:id', requireAuth, async (req, res) => {

2 const { id } = req.params;

3 if (req.user.id !== id) return res.status(403).end();

4 // merge whatever fields the client sent

5 const updated = await User.findByIdAndUpdate(

6 id,

7 { $set: req.body },

8 { new: true }

9 );

10 res.json(updated);

11});

Which questions mattered is sealed until you submit. Telling you now would just be handing over the edge cases.