Question

Is there a difference in terms of security between these two models to be given to View? Ie. in the second example can a webuser/hacker access the methods in any way?

public class ObjectViewModel
  { 
   public PropertyA {get;set;}
   public PropertyB {get;set;}
   public PropertyC {get;set;}
  }



public class ObjectViewModel2
  {
   public PropertyA {get; private set;}
   public PropertyB {get; private set;}
   public PropertyC {get; private set;}

   private void SetPropertyA()
   {
      ...GetDataFromRepository();
   } 

   private void SetPropertyB()
   {
      ...GetDataFromRepository();
   } 

   private void SetPropertyC()
   {
      ...GetDataFromRepository();
   } 
}

Answer 1

First, the model itself is not exposed to the web browser. It’s only exposed to the view rendering engine which resides on the server. You can expose access via your actions to certain properties in your model, but these are only via query or form parameters. It won’t give access to the underlying methods.

Second, one thing you should know is that the default model binder requires that any properties you wish to set be available via public accessors. If you make a property with a private setter, it won’t updated via the model binder.