title: Create controller logic for ASP.Net MVC for logged in user
body: <p>I have the following models:</p>
  
  <pre><code>public class Expense
  {
      [Key]
      [DatabaseGeneratedAttribute(DatabaseGeneratedOption.Identity)]
      public int ID { get; set; }
      [Required]
      public string Name { get; set; }
      [Required]
      [Column(TypeName = "Money")]
      public decimal Limit { get; set; }
      [Required]
      [ForeignKey("UserProfile")]
      public int UserProfileId { get; set; }
      [Required]
      public virtual UserProfile UserProfile { get; set; }
  }
  
  [Table("UserProfile")]
  public class UserProfile
  {
      [Key]
      [DatabaseGeneratedAttribute(DatabaseGeneratedOption.Identity)]
      public int UserId { get; set; }
      public string UserName { get; set; }
      public virtual ICollection&lt;Expense&gt; Expenses { get; set; }
  }
  </code></pre>
  
  <p>I have a logged in user, and I would like that user to be able to add new Expenses. The create controller actions looks as follows:</p>
  
  <pre><code>    //
      // GET: /Expenses/Create
  
      public ActionResult Create()
      {
  
          return View();
      }
  
      //
      // POST: /Expenses/Create
  
      [HttpPost]
      public ActionResult Create(Expense expense)
      {            
          if (ModelState.IsValid)
          {
              UserProfile user = db.UserProfiles.Single(u =&gt; u.UserName == User.Identity.Name)
              user.Expenses.Add(expense);                
              db.SaveChanges();
              return RedirectToAction("Index");
          }
  
          return View(expense);
      }
  </code></pre>
  
  <p>With the view:</p>
  
  <pre><code>@model MoneyDrainPlug.Models.Expense
  
  @{
      ViewBag.Title = "Create";
  }
  
  &lt;h2&gt;Create&lt;/h2&gt;
  
  @using (Html.BeginForm()) {
      @Html.ValidationSummary(true)
  
      &lt;fieldset&gt;
          &lt;legend&gt;Expense&lt;/legend&gt;
  
          &lt;div class="editor-label"&gt;
              @Html.LabelFor(model =&gt; model.Name)
          &lt;/div&gt;
          &lt;div class="editor-field"&gt;
              @Html.EditorFor(model =&gt; model.Name)
              @Html.ValidationMessageFor(model =&gt; model.Name)
          &lt;/div&gt;
  
          &lt;div class="editor-label"&gt;
              @Html.LabelFor(model =&gt; model.Limit)
          &lt;/div&gt;
          &lt;div class="editor-field"&gt;
              @Html.EditorFor(model =&gt; model.Limit)
              @Html.ValidationMessageFor(model =&gt; model.Limit)
          &lt;/div&gt;        
          &lt;p&gt;
              &lt;input type="submit" value="Create" /&gt;
          &lt;/p&gt;
      &lt;/fieldset&gt;
  }
  
  &lt;div&gt;
      @Html.ActionLink("Back to List", "Index")
  &lt;/div&gt;
  
  @section Scripts {
      @Scripts.Render("~/bundles/jqueryval")
  }
  </code></pre>
  
  <p>When the post happens, ModelState.IsValid is false in the controller. This is because the there is no UserProfileId set in the expense. It does not help if I set the UserProfile and\or UserProfileId before calling ModelState.IsValid.</p>
  
  <p>What would be the correct and secure way of handling this? Surely I should not trust a UserProfileId sent from the client? </p>
  
  <p>In case it matters, I am using asp.net MVC 4.</p>
  
  <p>Thanks in advance    </p>