Should I use binding model or view model when using data from forms to avoid mass assigment attack?

Question

User-81839486 posted

I heard that I should have separate view model and binding model but which one use when taking data from forms?

Answer 1

User-821857111 posted

In Razor Pages, you should only add the [BindProperty] attribute to properties that you want to include in two-way binding. If you do that, you effectively declare a binding model as part of your view model (the PageModel). That will prevent an overposting attack.

Answer 2

User711641945 posted

Hi karol wolonciej,

I heard that I should have separate view model and binding model but which one use when taking data from forms?

As far as I know,you need use view model.In this approach you'll never bind against business objects or entities, and you'll only have properties available for the input you expect. Once the model is validated you can move values from the input model to the object you use in the next layer of software.

Best Regards,

Rena