Question

I’m trying to make a sign up wizard that will be 3 pages, but I’m not sure how I can pass the data between the pages.

At first I tried using return RedirectToAction("New", "Authentication", newUser);,
where newUser was the instance of the user which contains the initial first page info (which is their OpenId identifier and any extra meta data which the provider has provided.)

When I did this, I noticed all the data (which existed) was in the query string HEADER:

Request URL:http://localhost:1200/Account/New?UserId=0&OpenIds=System.Collections.Generic.List%601%5BSystem.String%5D
Request Method:GET
Status Code:200 OK

This makes me worried that it could be open to serious attack/abuse, especially if the openId identifier is there (not to mention that the OpenId value is incorrect, it didn’t serialize the IList<string> correctly.)

So does anyone have any suggestions?

Answer 1

I ended up using TempData to store the data between requests. And I also used TempData.Keep() to make sure it’s sticky for one more request for error handling, when I need to show some error message.