ASP.NET Core Interview Question #120

What is overposting and how can you prevent it?

Routing, Controllers & Model Binding Mid-Level Intermediate

Quick Interview Answer

Overposting occurs when a client submits fields that should not be editable and model binding assigns those values to properties on the bound object.

Detailed Explanation

Overposting occurs when a client submits fields that should not be editable and model binding assigns those values to properties on the bound object.

For example, binding an EF Core entity directly could allow a malicious request to submit IsAdmin, PriceApproved, OwnerId, or another sensitive property that the form did not visibly expose.

The preferred defense is to use dedicated request/view models containing only allowed input fields, then explicitly map those values to the domain or persistence model. This creates a clear input boundary.

Code Example

public class EditUserRequest
{
    public string DisplayName { get; set; } = string.Empty;
}

// Do not expose IsAdmin in the editable request model.
[HttpPost]
public IActionResult Edit(int id, EditUserRequest request)
{
    _userService.UpdateDisplayName(id, request.DisplayName);
    return RedirectToAction(nameof(Index));
}