在脚手架代码中发布编辑操作时，为什么要根据模型/隐藏输入中的 ID 检查 URL 中的 ID？

Question

If you create an "MVC Controller with view, using Entity Framework" using Visual Studio scaffolded code, an Edit method is created to respond to POST. This method contains a the check if (id != movie.ID) which appears to have no real value. This same pattern is used in the ASP.NET Core 3.1 tutorial :

[HttpPost]
[ValidateAntiForgeryToken]
public async Task<IActionResult> Edit(int id, [Bind("ID,Title,ReleaseDate,Genre,Price")] Movie movie)
{
    if (id != movie.ID)
    {
        return NotFound();
    }
    ...

The docs state

The HttpGet Edit method takes the movie ID parameter, looks up the movie using the Entity Framework FindAsync method, and returns the selected movie to the Edit view. If a movie cannot be found, NotFound (HTTP 404) is returned.

• What is the purpose of this check?
• It appears to have no real value - the client appears to be sending both values.
• Should I remove it? Should I keep it?

Answer 1

I think this is just a sanity check, to make sure the ID the client is posting to matches the ID in the data the client attaches in the POST request.

If the user is using the form from the view to submit the POST request, I don't see how you can get different value for the ID. But just in case of a client submitting the form without using your view, those ID values could be different. One of the examples could be using Postman.

If the POST URL is /movie/edit/7 , but ID from the post body is 6 for example, your application/you will need to decide what to do. So it's you, as the developer, to determine whether it has value or not to add a check like that.

I usually just ignore the ID from the URL if it's a POST request. There shouldn't be an ID on the URL if it's well constructed RESTful API endpoint anyway. So instead, my Controller will only work with the data from the posted-back view model:

[HttpPost]
//[ValidateAntiForgeryToken] - I think ASP.NET Core MVC automatically has that on
public async Task<IActionResult> Edit(MovieViewModel vm)
{
    if (ModelState.IsValid)
    {
        ...
    }

    ...
}

Answer 2

According to Microsoft

The scaffolder generates that. Feel free to remove it. In some cases it may be needed.