title: Asp.Net MVC 5 bind parameter exclusively from body
body: <p>I want to prevent posting sensitive data via url query string to a MVC 5 application.</p>
  
  <p>In MVC there is a <code>DefaultModelBinder</code>. The <code>DefaultModelBinder</code> looks for the <code>ActionMethod</code> parameters in the url query string, the body and the route. But my target is to bind the parameters exclusively from the body and <strong>not</strong> from route or query string.</p>
  
  <p>In Asp.Net WebApi there is such a concept. The Attribute [FromBody] will do the job: <a href="http://www.asp.net/web-api/overview/formats-and-model-binding/parameter-binding-in-aspnet-web-api" rel="noreferrer">http://www.asp.net/web-api/overview/formats-and-model-binding/parameter-binding-in-aspnet-web-api</a></p>
  
  <p>Is there something suitable for MVC?</p>
  
  <p>I´ve found the <code>System.Web.ModelBinding.FormAttribute</code> (<a href="https://msdn.microsoft.com/en-us/library/system.web.modelbinding.formattribute(v=vs.110).aspx" rel="noreferrer">https://msdn.microsoft.com/en-us/library/system.web.modelbinding.formattribute(v=vs.110).aspx</a>). However, if I decorate the parameter, it has no effect to the model binding.</p>