Overposting: Binding attribute v ViewModel

Dean Everhart 1,496

Is there a preference to methods to protect against over-posting between using the bind attribute or using a view model?

The tutorial refers to VIewmodels as an alternative to using the binding attribute but does not suggest that it is better...just an alternative way of doing it.

Re: Tutorial: [https://learn.microsoft.com/en-us/aspnet/core/tutorials/first-mvc-app/controller-methods-views?view=aspnetcore-6.0#additional-resources

The [Bind] attribute is one way to protect against over-posting. You should only include properties in the [Bind] attribute that you want to change. For more information, see Protect your controller from over-posting. ViewModels provide an alternative approach to prevent over-posting.

AgaveJoe 26,191 Reputation points

2023-01-18T18:24:42.98+00:00

Implementing [Bind] or designing a ViewModel is a design choice that you need to make. Perhaps create a proof of concept to determine what approach you like.

I prefer to use a ViewModel.

Dean Everhart 1,496

Thanks again for the response above.

I'm having a really hard time finding a basic (basic the operative word) tutorial on using a view model to bind data in Create and Edit action methods / views (which surprised me...one would think that this would be easier to find).

If you have any links to tutorials that deal with this topic, I would appreciate it.

As an exercise to learn, I'm just trying to bind a simple model through a view model:

Model

using System.ComponentModel.DataAnnotations;            // Date Format
using System.ComponentModel.DataAnnotations.Schema;

namespace WebApplication01.Models
{
    public class PropertySet01
    {
        public int Id { get; set; }

        public string? String01 { get; set; }

        public string? String02 { get; set; }

        public int? Int01 { get; set; }

        public int? Int02 { get; set; }

        [Column(TypeName = "decimal(18, 2)")]
        public int? Decimal01 { get; set; }

        [Column(TypeName = "decimal(18, 2)")]
        public int? Decimal02 { get; set; }

        public bool? Bool01 { get; set; }

        public bool? Bool02 { get; set; }

        [Display(Name = "DateTime01'")]
        [DataType(DataType.Date)]                       // [DataType(DataType.Date)] = only date, no time information
        public DateTime? DateTime01 { get; set; }

        [DataType(DataType.Date)]
        public DateTime? DateTime02 { get; set; }
    }
}

My next step will be to post this as a new question and see what responses there are.

Any direction you might offer would be appreciated.

Thanks again.

AgaveJoe 26,191 Reputation points

2023-02-01T16:11:37.0533333+00:00

ViewModels and the Bind attribute are tools. You get to decide when to use the tool. I preferer to use a ViewModel that only contains the properties the View needs. Use Bind when there are model properties not used by the View and you want to restrict what properties are bound.

There could be a larger discussion about general design but that is subjective as well and depends on how your application works.
Dean Everhart 1,496 Reputation points

2023-02-01T16:50:28.5333333+00:00

Yes, I would like to learn how to use a view model to bind data. I would like to do it to a simple single database as an exercise.

If you know of any tutorials, I'd appreciate a link (I've been having a very hard time finding any tutorials).

Thanks, as always.
AgaveJoe 26,191 Reputation points

2023-02-01T18:22:49.84+00:00

You are over thinking the concept. Every MVC application technically has a view model. It's the M in MVC. When we talk about using a view model in design we referring to a general data interface needed to make the controller-to-view and view-to-controller (the UI) to function as expected. It is also assumed the view model is not part of the data access and therefore an MVC application can function, or be tested, without a database.

Razor Pages templates come with a built-in view model.

1 answer

Dean Everhart 1,496 Reputation points

2023-02-01T18:53:17.36+00:00

Perhaps I'm using the wrong spelling: I'm trying to use a view model (or viewmodel) as an intermediary between the view and the model. It would be located in a ViewModels folder at the following path: ProjectName.Models.ViewModels.

My understanding is that it is a preferable way to bind data rather than the bind attribute in the Create and edit action methods / views.
Please sign in to rate this answer.
AgaveJoe 26,191 Reputation points

2023-02-01T19:53:55.05+00:00

What model? An entity?

Let's image you have an HTML create form with three fields; first name, last name, and email address. The table that stores this data has Id, FirstName, LastName, Email, UpdateDate, and CreateDate columns. You also have an entity with properties that model the table columns.

Let's also image the view is strongly typed using the entity which has three more fields than the HTML form; Id, CreateDate, and UpdateDate. The [Bind] attribute comes in handy here because it stops the client from over posting. An alternative option is to create a strongly typed view based on a view model which only contains the three fields needed to complete the create task.

The later design, the view model, take a little extra work because at some point the view model is usually mapped to the entity to do the insert. Our conversation is moving to a layer design. The view model separates the UI from the data access layer and is usually the desired design direction.

Another reason you might use the [Bind] attribute is you've created a single view model for CRUD operations. The Create action still only needs three fields. The Retrieve needs all six, the update needs at least five and delete needs one, the Id.

Again, a view model and [Bind] are tools that you get to use however you like.

With that being said, if you are using Entity Framework entities in an MVC application's Views, that only works out for very simple applications. Entity Framework is a data access API and for professional applications EF exists behind services like Web API.
Sign in to comment