How to fix Mass Assignment: Insecure Binder Configuration (API Abuse, Structural) in java

Question

I have a Controller class with the below two methods for finding a doctors (context changed). Getting the Mass Assignment: Insecure Binder Configuration (API Abuse,

Answer 1

Simple question - how your mapper can instantionate the bean? Here is answer / example. You can pass that data by query parameter, or in header. However that would be strange. Better is to have that methods with @QueryParam providing location, or name. That way it will be easier to protect your application.

As a side note, query has limited length, so if your search form is big and strange, @POST can be good idea, and that way you can pass all the data. For this, simple example that would be overkill.