ASP.NET Core MVC Interview Question #120

How should sensitive data be handled in MVC forms?

Authentication, Authorization, Security & State Management Mid-Level Intermediate

Quick Interview Answer

Do not trust hidden fields, disabled-looking controls, query strings, or other client-submitted values as authoritative security data. Values such as owner IDs, prices, roles, or approval status should be obtained or verified on the server when they affect security or business integrity.

Detailed Explanation

Use HTTPS, avoid exposing secrets in HTML, logs, or URLs, and use purpose-specific input models containing only fields the user is allowed to edit.

Code Example

public class ProfileInputModel
{
    [Required]
    public string DisplayName { get; set; } = string.Empty;

    // No IsAdmin, OwnerId, or protected account state.
}