ASP.NET Core MVC Interview Question #36
What is overposting in ASP.NET Core MVC?
Controllers, Actions, Model Binding & Action Results Junior Beginner
Quick Interview Answer
Overposting occurs when model binding allows a client to set properties that the UI was not intended to modify. This is particularly dangerous when persistence entities contain fields such as IsAdmin, Approved, OwnerId, PriceOverride, or internal status values.
Detailed Explanation
Overposting occurs when model binding allows a client to set properties that the UI was not intended to modify. This is particularly dangerous when persistence entities contain fields such as IsAdmin, Approved, OwnerId, PriceOverride, or internal status values.
The strongest general defense is to use purpose-specific input models or ViewModels containing only permitted fields, then explicitly map those values to the domain entity.
Code Example
public class UserProfileInputModel
{
public string DisplayName { get; set; } = string.Empty;
}
// Do not expose IsAdmin or other protected fields
// in a client-editable input model.