Implement a profile update endpoint that cannot bind privileged entity fields from JSON.

• Bind a dedicated request type.
• Map allowed fields explicitly.
• Resolve the user id from the authenticated principal.
• Let the server own audit timestamps.

I make the writable contract smaller than the entity. Strict JSON unmapped-member handling catches client mistakes, while explicit assignment is the final defense against privileged field updates.

builder.Services.ConfigureHttpJsonOptions(options =>
    options.SerializerOptions.UnmappedMemberHandling = JsonUnmappedMemberHandling.Disallow);

app.MapPut("/me/profile", async Task<Results<NoContent, NotFound>>
    (UpdateProfileRequest request, ClaimsPrincipal principal,
     AppDbContext db, TimeProvider clock, CancellationToken ct) =>
{
    var userId = principal.RequireUserId();
    var user = await db.Users.SingleOrDefaultAsync(x => x.Id == userId, ct);
    if (user is null) return TypedResults.NotFound();

    user.DisplayName = request.DisplayName.Trim();
    user.Locale = request.Locale;
    user.UpdatedAt = clock.GetUtcNow();
    await db.SaveChangesAsync(ct);
    return TypedResults.NoContent();
}).RequireAuthorization();

public sealed record UpdateProfileRequest(string DisplayName, string Locale);

The DTO documents writable fields and explicit assignment stays readable during review. Strict unknown-member handling is a compatibility choice; if an API intentionally tolerates additive client fields, mapping still protects privileged columns.

• The current user was deleted.
• Display name is blank.
• An older client sends a retired field.
• A payload attempts to change owner id.

• Send privileged JSON fields.
• Assert role and status remain unchanged.
• Verify identity comes from claims, not the body.

• Binding the entity directly.
• Using reflection-based blanket mapping.
• Taking user id from JSON.
• Assuming hidden UI fields cannot be submitted.