Laravel Mass Assignment Vulnerability: How to Protect Eloquent Models with $fillable and $guarded

The Problem

How to Fix

1. 1

   Add $fillable to every Eloquent model

   Explicitly list the columns that can be mass-assigned:

   class User extends Model
   {
       protected $fillable = [
           'name',
           'email',
           'password',
       ];
   }

   Never include sensitive columns like is_admin, role, email_verified_at, or balance in $fillable.

2. 2

   Or use $guarded as a blocklist

   If you prefer a blocklist approach, set $guarded to protect specific columns:

   class User extends Model
   {
       protected $guarded = [
           'id',
           'is_admin',
           'role',
           'email_verified_at',
       ];
   }

   Warning: $guarded = [] (empty array) disables all protection and is equivalent to having no mass assignment guard at all. Never use this in production.

3. 3

   Validate and filter input before creating models

   Even with $fillable, always validate input first:

   $validated = $request->validate([
       'name' => 'required|string|max:255',
       'email' => 'required|email|unique:users',
   ]);

   User::create($validated);

   Using $request->validate() returns only the validated fields, providing a second layer of protection beyond $fillable.

4. 4

   Audit existing models for missing protection

   Search your codebase for models without mass assignment protection:

   grep -rL 'fillable\|guarded' app/Models/

   This lists all model files that don't contain either $fillable or $guarded. Fix each one before deploying.

How to Verify

curl -X POST https://yourapp.com/api/users \
  -d 'name=Test&email=test@test.com&is_admin=1'

Prevention

Frequently Asked Questions