Question

In my ASP .NET MVC 3 web application, I am using a lot of partial views. I am using these partial views in some cases through normal render calls

<div id="attributes">
   @Html.Partial("_DeviceAttributesPartial", Model.DeviceAttributes)
</div>

and in other cases using AJAX:

$.ajax({
   url: '@Url.Action("GetDeviceAttributes")',
   type: 'POST',
   data: { deviceID: device, deviceTypeID: devicetype, deviceModelID: devicemodel },
   success: function (result) {
      // when the AJAX succeeds refresh the device model drop down holder
      $('#attributes').html(result);
   }
});

I was trying to find a way to stop users from going directly to my partial view ActionResults such as this one:

public ActionResult GetDeviceModelList(int deviceTypeID)
{
   var model = new EditDeviceViewModel();

   var deviceType = _db.DeviceTypes.Single(t => t.ID == deviceTypeID);
   model.DeviceModelList = new SelectList(_db.DeviceModels.Where(m => m.DeviceType.ID == deviceType.ID), "ID", "Model");

   return PartialView("_DeviceModelListPartial", model);
}

I stumbled up on this answer to simply make the action private. I gave it a try and it seems to work, however I feel uneasy about doing that, not knowing what other side effects might happen.

So my questions are:

• Is setting actions to private a sensible thing to do?
• What other side effects might occur from doing this?
• How about actions that are only available through a POST?

NB: Most of the partial action result functions are [HttpPost] so I don’t believe they are accessible anyway.

Answer 1

Reducing an action visibility will prevent that action from being available outside the controller. Actions that are decorated by the [HttpPost] attribute are available to everybody but only via a POST http request, which is a little beyond the average user to do.

Consider decorating the actions with the [ChildActionOnly] attribute that you won’t be accessing via a POST, instead decorate these actions with [HttpPost].