Model binding sources — ASP.NET Core MVC (and Razor Pages)

5. Model binding sources

Basic★ Must knowLesson 5 of 15

Model binding maps HTTP request data to action parameters. Sources in order: form fields → route values → query string (and files). Explicit attributes override:

csharp

public IActionResult Search(
    [FromQuery] string q,
    [FromRoute] int page,
    [FromForm] string sort,
    [FromHeader(Name = "X-Tenant")] string tenant,
    [FromServices] IClock clock,
    [FromBody] SearchFilter filter)   // body (JSON) — typical in Web API, only one [FromBody] per action
{ ... }

Complex types bind by property name (Address.City → input.Address.City). Collections bind by index (Items[0].Qty).

Over-posting / mass assignment: binding directly to entities lets attackers set fields like IsAdmin. Use view models / input models with only the allowed fields (or [Bind("Name,Price")]).