title: How can I detect an overposting attack in ASP.MVC during model binding?
body: <p>I want to determine if a user is attempting an <a href="https://www.asp.net/mvc/overview/getting-started/getting-started-with-ef-using-mvc/implementing-basic-crud-functionality-with-the-entity-framework-in-asp-net-mvc-application#overpost" rel="nofollow noreferrer">overposting attack</a> in Asp.NET MVC. </p>
  
  <p>How can I determine if someone is sending special values (via Fiddler for example) to my controller? </p>
  
  <p>Note the "bind" attribute below</p>
  
  <blockquote>
  <pre><code>[HttpPost]
  [ValidateAntiForgeryToken]
  public ActionResult Create([Bind(Include = "LastName, FirstMidName, EnrollmentDate")]Student student)
  {
      try
      {
          if (ModelState.IsValid)
          {
              db.Students.Add(student);
              db.SaveChanges();
              return RedirectToAction("Index");
          }
      }
      catch (DataException /* dex */)
      {
          //Log the error (uncomment dex variable name and add a line here to write a log.
          ModelState.AddModelError("", "Unable to save changes. Try again, and if the problem persists see your system administrator.");
      }
      return View(student);
  }
  </code></pre>
    
    <p>The Bind attribute is one way to protect against over-posting in
    create scenarios. For example, suppose the Student entity includes a
    Secret property that you don't want this web page to set.</p>
  
  <pre><code>   public class Student
     {
        public int ID { get; set; }
        public string LastName { get; set; }
        public string FirstMidName { get; set; }
        public DateTime EnrollmentDate { get; set; }
        public string Secret { get; set; }
  
        public virtual ICollection&lt;Enrollment&gt; Enrollments { get; set; }
     }
  </code></pre>
    
    <p>Even if you don't have a Secret field on the web page, a hacker could
    use a tool such as fiddler, or write some JavaScript, to post a Secret
    form value. Without the Bind attribute limiting the fields that the
    model binder uses when it creates a Student instance, the model binder
    would pick up that Secret form value and use it to create the Student
    entity instance. Then whatever value the hacker specified for the
    Secret form field would be updated in your database. The following
    image shows the fiddler tool adding the Secret field (with the value
    "OverPost") to the posted form values.</p>
  </blockquote>