From bed43cdf4570e7a7b7fffae6d2cc34e5150ba665 Mon Sep 17 00:00:00 2001 From: Stephen Halter Date: Mon, 24 Aug 2026 20:11:02 -0700 Subject: [PATCH 1/3] Document form-mapping attribute limitations Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> --- aspnetcore/blazor/forms/binding.md | 8 +++++++- .../minimal-apis/includes/parameter-binding8-10.md | 5 ++++- aspnetcore/fundamentals/minimal-apis/parameter-binding.md | 6 +++--- 3 files changed, 14 insertions(+), 5 deletions(-) diff --git a/aspnetcore/blazor/forms/binding.md b/aspnetcore/blazor/forms/binding.md index 1bb3cef05ece..0627945ea019 100644 --- a/aspnetcore/blazor/forms/binding.md +++ b/aspnetcore/blazor/forms/binding.md @@ -1,10 +1,11 @@ --- title: ASP.NET Core Blazor forms binding +ai-usage: ai-assisted author: guardrex description: Learn how to use binding in Blazor forms. monikerRange: '>= aspnetcore-3.1' ms.author: wpickett -ms.date: 11/11/2025 +ms.date: 08/24/2026 uid: blazor/forms/binding --- # ASP.NET Core Blazor forms binding @@ -121,10 +122,15 @@ Binding supports: * Types with constructors * Enums +## Form-mapping attributes + You can also use the [`[DataMember]`](xref:System.Runtime.Serialization.DataMemberAttribute) and [`[IgnoreDataMember]`](xref:System.Runtime.Serialization.IgnoreDataMemberAttribute) attributes to customize model binding. Use these attributes to rename properties, ignore properties, and mark properties as required. When binding a type with constructor parameters, if a constructor parameter matches a property by name, the constructor parameter takes precedence. The mapper uses the property’s explicit `DataMember.Name`, if present, as the form field name, but otherwise ignores the property’s mapping attributes. Constructor parameters are always required. +> [!WARNING] +> Blazor form mapping with [`[SupplyParameterFromForm]`](xref:Microsoft.AspNetCore.Components.SupplyParameterFromFormAttribute) doesn't use MVC model binding. Attributes in the `Microsoft.AspNetCore.Mvc.ModelBinding` namespace, such as [`[BindNever]`](xref:Microsoft.AspNetCore.Mvc.ModelBinding.BindNeverAttribute) and [`[BindRequired]`](xref:Microsoft.AspNetCore.Mvc.ModelBinding.BindRequiredAttribute), aren't supported. Don't use these attributes to prevent overposting. Instead, use a dedicated form model, view model, or data transfer object (DTO) that includes only the properties users are allowed to modify. For more information, see [Mitigate overposting attacks](xref:blazor/forms/index#mitigate-overposting-attacks). + ## Additional binding options Additional model binding options are available from when calling : diff --git a/aspnetcore/fundamentals/minimal-apis/includes/parameter-binding8-10.md b/aspnetcore/fundamentals/minimal-apis/includes/parameter-binding8-10.md index cd2232acb5ed..97b423b4d047 100644 --- a/aspnetcore/fundamentals/minimal-apis/includes/parameter-binding8-10.md +++ b/aspnetcore/fundamentals/minimal-apis/includes/parameter-binding8-10.md @@ -253,6 +253,9 @@ Binding is supported for: * Collections, for example [List](/dotnet/api/system.collections.generic.list-1) and [Dictionary](/dotnet/api/system.collections.generic.dictionary-2) * Complex types, for example, `Todo` or `Project` +> [!WARNING] +> Complex-type form mapping with [`[FromForm]`](xref:Microsoft.AspNetCore.Mvc.FromFormAttribute) in Minimal APIs doesn't use MVC model binding. Attributes in the `Microsoft.AspNetCore.Mvc.ModelBinding` namespace, such as [`[BindNever]`](xref:Microsoft.AspNetCore.Mvc.ModelBinding.BindNeverAttribute) and [`[BindRequired]`](xref:Microsoft.AspNetCore.Mvc.ModelBinding.BindRequiredAttribute), aren't supported. Don't use these attributes to prevent overposting. Instead, use a dedicated input model or data transfer object (DTO) that includes only the properties clients are allowed to modify. + The following code shows: * A minimal endpoint that binds a multi-part form input to a complex object. @@ -264,7 +267,7 @@ In the preceding code: * The target parameter ***must*** be annotated with the [`[FromForm]`](xref:Microsoft.AspNetCore.Mvc.FromFormAttribute) attribute to disambiguate from parameters that should be read from the JSON body. * Binding from complex or collection types is ***not*** supported for Minimal APIs that are compiled with the Request Delegate Generator. -* The markup shows an additional hidden input with a name of `isCompleted` and a value of `false`. If the `isCompleted` checkbox is checked when the form is submitted, both values `true` and `false` are submitted as values. If the checkbox is unchecked, only the hidden input value `false` is submitted. The ASP.NET Core model-binding process reads only the first value when binding to a `bool` value, which results in `true` for checked checkboxes and `false` for unchecked checkboxes. +* The markup shows an additional hidden input with a name of `isCompleted` and a value of `false`. If the `isCompleted` checkbox is checked when the form is submitted, both values `true` and `false` are submitted as values. If the checkbox is unchecked, only the hidden input value `false` is submitted. The ASP.NET Core form-mapping process reads only the first value when binding to a `bool` value, which results in `true` for checked checkboxes and `false` for unchecked checkboxes. An example of the form data submitted to the preceding endpoint looks as follows: diff --git a/aspnetcore/fundamentals/minimal-apis/parameter-binding.md b/aspnetcore/fundamentals/minimal-apis/parameter-binding.md index cd40b944f479..77312fd2b296 100644 --- a/aspnetcore/fundamentals/minimal-apis/parameter-binding.md +++ b/aspnetcore/fundamentals/minimal-apis/parameter-binding.md @@ -1,12 +1,12 @@ --- title: Parameter binding in Minimal API applications +ai-usage: ai-assisted author: wadepickett description: Learn how parameters are populated before invoking minimal route handlers. -ms.author: wpickett monikerRange: '>= aspnetcore-7.0' -ms.date: 07/16/2026 +ms.author: wpickett +ms.date: 08/24/2026 uid: fundamentals/minimal-apis/parameter-binding -ai-usage: ai-assisted --- # Parameter Binding in Minimal API apps From 8385a098f05baa97e6616bc12066ad61f906c5e8 Mon Sep 17 00:00:00 2001 From: Stephen Halter Date: Mon, 24 Aug 2026 20:18:46 -0700 Subject: [PATCH 2/3] Remove metadata-only article changes Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> --- aspnetcore/fundamentals/minimal-apis/parameter-binding.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/aspnetcore/fundamentals/minimal-apis/parameter-binding.md b/aspnetcore/fundamentals/minimal-apis/parameter-binding.md index 77312fd2b296..cd40b944f479 100644 --- a/aspnetcore/fundamentals/minimal-apis/parameter-binding.md +++ b/aspnetcore/fundamentals/minimal-apis/parameter-binding.md @@ -1,12 +1,12 @@ --- title: Parameter binding in Minimal API applications -ai-usage: ai-assisted author: wadepickett description: Learn how parameters are populated before invoking minimal route handlers. -monikerRange: '>= aspnetcore-7.0' ms.author: wpickett -ms.date: 08/24/2026 +monikerRange: '>= aspnetcore-7.0' +ms.date: 07/16/2026 uid: fundamentals/minimal-apis/parameter-binding +ai-usage: ai-assisted --- # Parameter Binding in Minimal API apps From c0defdfa426c4cf9de899bd4636b7aa64f6ea79c Mon Sep 17 00:00:00 2001 From: Stephen Halter Date: Tue, 25 Aug 2026 07:54:04 -0700 Subject: [PATCH 3/3] Address form-mapping review feedback Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> --- aspnetcore/blazor/forms/binding.md | 7 ++----- .../minimal-apis/includes/parameter-binding8-10.md | 2 +- 2 files changed, 3 insertions(+), 6 deletions(-) diff --git a/aspnetcore/blazor/forms/binding.md b/aspnetcore/blazor/forms/binding.md index 0627945ea019..36356d03e2b3 100644 --- a/aspnetcore/blazor/forms/binding.md +++ b/aspnetcore/blazor/forms/binding.md @@ -122,15 +122,10 @@ Binding supports: * Types with constructors * Enums -## Form-mapping attributes - You can also use the [`[DataMember]`](xref:System.Runtime.Serialization.DataMemberAttribute) and [`[IgnoreDataMember]`](xref:System.Runtime.Serialization.IgnoreDataMemberAttribute) attributes to customize model binding. Use these attributes to rename properties, ignore properties, and mark properties as required. When binding a type with constructor parameters, if a constructor parameter matches a property by name, the constructor parameter takes precedence. The mapper uses the property’s explicit `DataMember.Name`, if present, as the form field name, but otherwise ignores the property’s mapping attributes. Constructor parameters are always required. -> [!WARNING] -> Blazor form mapping with [`[SupplyParameterFromForm]`](xref:Microsoft.AspNetCore.Components.SupplyParameterFromFormAttribute) doesn't use MVC model binding. Attributes in the `Microsoft.AspNetCore.Mvc.ModelBinding` namespace, such as [`[BindNever]`](xref:Microsoft.AspNetCore.Mvc.ModelBinding.BindNeverAttribute) and [`[BindRequired]`](xref:Microsoft.AspNetCore.Mvc.ModelBinding.BindRequiredAttribute), aren't supported. Don't use these attributes to prevent overposting. Instead, use a dedicated form model, view model, or data transfer object (DTO) that includes only the properties users are allowed to modify. For more information, see [Mitigate overposting attacks](xref:blazor/forms/index#mitigate-overposting-attacks). - ## Additional binding options Additional model binding options are available from when calling : @@ -236,6 +231,8 @@ The following `NamedFormsWithScope` component uses the library's `HelloFormFromL The `[SupplyParameterFromForm]` attribute indicates that the value of the associated property should be supplied from the form data for the form. Data in the request that matches the name of the property is bound to the property. Inputs based on `InputBase` generate form value names that match the names Blazor uses for model binding. Unlike component parameter properties (`[Parameter]`), properties annotated with `[SupplyParameterFromForm]` aren't required to be marked `public`. +Blazor form mapping with [`[SupplyParameterFromForm]`](xref:Microsoft.AspNetCore.Components.SupplyParameterFromFormAttribute) doesn't use MVC model binding. Attributes in the namespace, such as [`[BindNever]`](xref:Microsoft.AspNetCore.Mvc.ModelBinding.BindNeverAttribute) and [`[BindRequired]`](xref:Microsoft.AspNetCore.Mvc.ModelBinding.BindRequiredAttribute), aren't supported. Don't use these attributes to prevent overposting. Instead, use a dedicated form model, view model, or data transfer object (DTO) that includes only the properties users are allowed to modify. For more information, see [Mitigate overposting attacks](xref:blazor/forms/index#mitigate-overposting-attacks). + You can specify the following form binding parameters to the [`[SupplyParameterFromForm]` attribute](xref:Microsoft.AspNetCore.Components.SupplyParameterFromFormAttribute): * : Gets or sets the name for the parameter. The name is used to determine the prefix to use to match the form data and decide whether or not the value needs to be bound. diff --git a/aspnetcore/fundamentals/minimal-apis/includes/parameter-binding8-10.md b/aspnetcore/fundamentals/minimal-apis/includes/parameter-binding8-10.md index 97b423b4d047..d5d253f6a090 100644 --- a/aspnetcore/fundamentals/minimal-apis/includes/parameter-binding8-10.md +++ b/aspnetcore/fundamentals/minimal-apis/includes/parameter-binding8-10.md @@ -254,7 +254,7 @@ Binding is supported for: * Complex types, for example, `Todo` or `Project` > [!WARNING] -> Complex-type form mapping with [`[FromForm]`](xref:Microsoft.AspNetCore.Mvc.FromFormAttribute) in Minimal APIs doesn't use MVC model binding. Attributes in the `Microsoft.AspNetCore.Mvc.ModelBinding` namespace, such as [`[BindNever]`](xref:Microsoft.AspNetCore.Mvc.ModelBinding.BindNeverAttribute) and [`[BindRequired]`](xref:Microsoft.AspNetCore.Mvc.ModelBinding.BindRequiredAttribute), aren't supported. Don't use these attributes to prevent overposting. Instead, use a dedicated input model or data transfer object (DTO) that includes only the properties clients are allowed to modify. +> Complex-type form mapping with [`[FromForm]`](xref:Microsoft.AspNetCore.Mvc.FromFormAttribute) in Minimal APIs doesn't use MVC model binding. Attributes in the namespace, such as [`[BindNever]`](xref:Microsoft.AspNetCore.Mvc.ModelBinding.BindNeverAttribute) and [`[BindRequired]`](xref:Microsoft.AspNetCore.Mvc.ModelBinding.BindRequiredAttribute), aren't supported. Don't use these attributes to prevent overposting. Instead, use a dedicated input model or data transfer object (DTO) that includes only the properties clients are allowed to modify. The following code shows: