Viewmodel security in asp.net mvc
Is there a security difference between these two models that the View should be exposed to? I.e. in the second example, can the web user / hacker get access to the methods in some way?
public class ObjectViewModel
{
public PropertyA {get;set;}
public PropertyB {get;set;}
public PropertyC {get;set;}
}
public class ObjectViewModel2
{
public PropertyA {get; private set;}
public PropertyB {get; private set;}
public PropertyC {get; private set;}
private void SetPropertyA()
{
...GetDataFromRepository();
}
private void SetPropertyB()
{
...GetDataFromRepository();
}
private void SetPropertyC()
{
...GetDataFromRepository();
}
}
a source to share
First, the model itself is not displayed in the web browser. It is only available to the view rendering engine that resides on the server. You can open access through your actions to specific properties in your model, but this is only through request or form parameters. It will not give access to the main methods.
Second, one thing you should be aware of is that the default binding device requires that any properties you wish to set be accessible through public access devices. If you create a property using a private setter, it won't update through model binding.
a source to share
When traversing the view engine and returning something like Json (model) or XmlResult (model), you can provide your data. However, since your data is serialized your viewmodel methods no longer apply.
a source to share