防止在 PostModel 上绑定

考虑(后)模型:

public class User
{
    public string FirstName { get; set; }
    public bool IsAdmin { get; set; }
}

有这样的观点:

@using (Html.BeginForm()) {
    @Html.EditorFor(model => model.FirstName)
    <input type="submit" value="Save" />       
}

为了防止恶意用户分配 IsAdmin,你可以在操作中使用 Bind 属性:

[HttpPost]
public ViewResult Edit([Bind(Exclude = "IsAdmin")] User user)
{
    // ...
}