ASP.NET Core MVC Interview Question #192

How would you protect an MVC application from mass assignment or overposting?

Senior Practical MVC Scenarios & Production Architecture Senior Advanced

Quick Interview Answer

Use dedicated input models containing only properties the user is permitted to submit. Load the target entity on the server and explicitly map approved values rather than binding a persistence entity containing protected fields.

Detailed Explanation

Use dedicated input models containing only properties the user is permitted to submit. Load the target entity on the server and explicitly map approved values rather than binding a persistence entity containing protected fields.

Authorization-sensitive properties such as OwnerId, IsAdmin, approval state, or internal prices must be derived or verified on the server, regardless of whether the corresponding fields are absent or hidden in the HTML.

Code Example

public sealed class ProfileEditInput
{
    public string DisplayName { get; set; } = "";
}

var user = await db.Users.FindAsync(id);
user.DisplayName = model.DisplayName;
// Protected fields are not copied from the request.