title: How to Validate Request Body by allowing only attributes assigned in the Model of an asp.net core web api app
body: <p>I have an ASP.NET CORE Web API app and placed a Model as:</p>
  <pre><code>public class SamplePayload
      { 
          public string Attribute1 { get; set; }
          public string Attribute2 { get; set; }
      }
  </code></pre>
  <p>then my controller looks like:</p>
  <pre><code>[ApiController]
  public class SampleController : ControllerBase
  {
      [HttpPost]
      public async Task&lt;string&gt; Add(SamplePayload samplePayload)
      {
          if (!ModelState.IsValid)
          { 
              //Throw Error
          }
  
          return  &quot;Hello&quot;;
      }
  }
  </code></pre>
  <p>However, the Action still accepts the payload if the Request Body had its payload like this (with additional attributes):</p>
  <pre><code>{
      &quot;Attribute1&quot;:&quot;Value1&quot;,
      &quot;Attribute2&quot;:&quot;Value2&quot;,
      &quot;EvilAttribute&quot;:&quot;EvilValue&quot;
  }
  </code></pre>
  <p>As you see, <code>EvilAttribute</code> is not a valid attribute according to the Model, but still, the controller accepts it, and <code>Model.IsValid</code> also returns <code>true</code> despite the fact that I have <code>[ApiController]</code> assigned on top of the controller.</p>
  <p>My question is how can I do validation to check that only attributes defined in the Model need to be passed in the Request body? Doesn't ASP.NET core offer simpler handling?</p>
  <p><strong>Note:</strong></p>
  <p>The reason for this requirement is, Under a Vulnerability assessment done by an independent assessor, highlighted that my Endpoint</p>
  <blockquote>
  <p>accepts additional parameters in request body</p>
  </blockquote>
  <p>The Assessment quoted as:</p>
  <blockquote>
  <ul>
  <li>Test Category: Mass Assignment;</li>
  <li>Test Conducted: Adding additional parameters to the requests</li>
  <li>Findings: Additional parameters accepted with a request body</li>
  </ul>
  <p>Recommendations:</p>
  <ul>
  <li>If possible, avoid using functions that automatically bind a client's input into code variables or internal objects.</li>
  <li>Whitelist only the properties that should be updated by the client.</li>
  <li>If applicable, explicitly dene and enforce schemas for the input data payloads.</li>
  </ul>
  </blockquote>