error on Django drf ModelSerializer update method

Question

I have a very strange error, this is my serializer class

class user_ser(ModelSerializer):
    class Meta:
        model = User
        fields = '__all__'
        depth = 1

whenever I send an API request to update user data, i got default values for is_staff and is_superuser

in the image below I send only email and password

example:

look what I got:(

this is the validated_data for the update method is:

I did not add is_staff or anything else to the request body, so why is that happening.

Answer 1

That's normal behavior; is_staff and is_superuser are default fields in Django used for authorization of admin users. You can view them as columns in the DB.

The real problem comes from using fields = '__all__' in the Meta class. This is an anti-pattern since you can expose fields you didn't intend to expose. You should explicitly display fields that you intend to use.

Explicit is better than implicit.