Q:

Can ASP.NET core view models be tampered with?

Say I have this view model:
public class UserSettingsViewModel
{
    public string UserId { get; set; }
    public string NewPassword { get; set; }
}

I return the View like this:
return View(new UserSettingsViewModel { UserId = "someone" });

Then in the view I have a form with asp-for="NewPassword" to change the password.
When the form is submitted, do I have to recheck UserId or can I be absolutely sure that UserId has not been tampered with? How does ASP.NET know which properties can be edited by the user? When a form is submitted, can I trust any of its properties and assume they haven't been modified?

A:

When a form is submitted, can I trust any of its properties and assume they haven't been modified?

Nope.  You can't trust the client in any shape or form, everything you ever get sent from the client needs to be re-validated on the server.
In this case, that means checking that whoever sent the request has the necessary permissions to modify the password for the user they supplied, whether that's the same user you sent out in the initial request or not.  Or if you know which one you sent out, you could return a Bad Request response on the 2nd one if the users don't match.  It's really up to how stateless (or not) your webserver is.

