Binding security

A whole different subject now. We know that ASP.NET Core automatically binds submitted values to model classes, but what would happen if we hijacked a request and asked ASP.NET to bind a different user or role than the one we have? For example, consider if we have a method that updates the user profile using the following model:

public class User
{
    public string Id { get; set; }
    public bool IsAdmin { get; set; }
    //rest of the properties go here
}

If this model is committed to the database, it is easy to see that if we pass a value of IsAdmin=true, then we would become administrators instantly! To prevent this situation, we should do either of the following:

• Move out sensitive properties from the public model, the one that is retrieved from the data sent by the user
• Apply [BindNever] attributes to these sensitive properties, like this:

[BindNever]
public bool IsAdmin { get; set; }

In the...