What does it mean for a property to be [Required] and nullable?

by

The reason for making a property nullable and marked with the [Required] attribute is to protect against under-posting attacks. It also allows you to display an initial empty value in the view rather than the default value for the property. This is typically done with value type properties in view models.

An under-posting attack is where a malicious user modifies the request to omit a value for the property in the request. If the property was DateTime (not nullable), then the DefaultModelBinder will initialize the value its default (01/01/0001) and no ModelState error would be generated. As a result, that value may then be saved even though its not what you may be expecting.

If the property is DateTime? (nullable) and [Required], then if a malicious user did omit the property in the request, then a ModelState error will be generated because a value is expected in the request, and the view would be returned, therefore the invalid data will not be saved.

Refer also Brad Wilson’s article Input Validation vs. Model Validation in ASP.NET MVC and the section titled The “Under-Posting” Problem.

More Related Contents:

  1. ASP.NET MVC: Custom Validation by DataAnnotation
  2. Disable Required validation attribute under certain circumstances
  3. displayname attribute vs display attribute
  4. Assign format of DateTime with data annotations?
  5. Is the DataTypeAttribute validation working in MVC2?
  6. Opposite of [compare(” “)] data annotation in .net?
  7. Using DataAnnotations to compare two model properties
  8. better way to load 2 dropdown in mvc
  9. How do I use a C# keyword as a property name?
  10. ASP.NET MVC Binding to a dictionary
  11. Dependency Injection in attributes
  12. How to get the public IP address of a user in C#
  13. How to call another controller Action From a controller in Mvc
  14. Web API Put Request generates an Http 405 Method Not Allowed error
  15. When I post back to my controller all values for my model are null
  16. How to update a claim in ASP.NET Identity?
  17. ModelState.IsValid == false, why?
  18. Posting JSON Data to ASP.NET MVC
  19. How to override an existing extension method
  20. How to flatten an ExpandoObject returned via JsonResult in asp.net mvc?
  21. MVCBuildViews not working correctly
  22. ASP.NET Web API : Correct way to return a 401/unauthorised response
  23. Do asynchronous operations in ASP.NET MVC use a thread from ThreadPool on .NET 4
  24. ‘object’ does not contain a definition for ‘X’
  25. How to redirect to Index from another controller?
  26. How to manually validate a model with attributes?
  27. How to retain spaces in DropDownList – ASP.net MVC Razor views
  28. Render partial from different folder (not shared)
  29. How to route EVERYTHING other than Web API to /index.html
  30. JSON Deserialization – String Is Automatically Converted To Int

Leave a Comment