Overposting is a security vulnerability caused by binding client-supplied fields directly to an entity. Fields that were not intended for editing may then become writable. section 12.4.1
Prevent overposting by keeping request binding separate from persistence:
- Bind the request to a purpose-specific command or input model rather than directly to the database entity. section 12.4.1 section 16.4
- Copy only permitted properties into the entity before saving it. section 12.4.1
- Avoid applying [BindProperties] broadly; bind a single property with [BindProperty] when using Razor Pages. section 16.4
Creating a recipe safely
A POST handler accepts CreateRecipeCommand, creates a new Recipe, and explicitly copies fields such as Name, Method, and IsVegetarian. It then adds the entity to AppDbContext and saves it. The client cannot choose arbitrary Recipe properties through direct entity binding. section 12.4.1
