In my experience, database models are rarely the same as on web pages. You always need some kind of change. Hence the use of ViewModel s. Another drawback is that all web pages using your ViewModel will not be broken if the entity model is changed.
In terms of security, if you have a public ActionResult Save(MyEntityModel model) , this can lead to a security violation, as the user can figure out how to send values ββto properties that should not be changed (for example, Role , Status , IsAdmin or something still).
Instead, check out the mapper (e.g. automapper ) and put the attributes in the ViewModel.
jgauffin
source share