Question

I had to for some reason use a hidden field to persist an Id that was originally sent to my view (a ViewModel is sent to my view with this Id). I know I’m sending a valid Id value…that’s not the issue.

So for example I’m seding in a ViewModel that has a CarId. During runtime, I check and it’s a valid integer, the same integer I passed to it from the controller’s action that sent it to this view.

The issue is, since I’m not using/referencing that Id anywhere in the view’s markup via Razor, I think that’s why it’s not persisted back during postback. Because I notice that when I do refrence that field in markup, it’s included/persisted with postback.

Even though I have this in the layout, specifying to persist the entire model itself, it doesn’t persist that Id when I’m not using it in the form when it hits my Update action in the related controller:

@using (Html.BeginForm(null, null, FormMethod.Post, new { @model = Model }))

So when this posts back, I have to add this or else the Id is not persisted with the other values in the ViewModel

@Html.HiddenFor(model => model.CarId )

Anyone know what I’m missing here as in fundamentals?

Answer 1

Your POST action will only receive data which is actually in the form.
It doesn’t magically get the rest of the model.

Note also that attackers can modify all of this data.