What is Asp.net MVC verification? (3) -- Remote verification and improvement (with source code)

Some input items in the form are fixed and do not change the verification rules, such as the character length and required fields. But some of them are dynamic. For example, if the registered user name has such a check, you need to access the server background to solve this problem. This article will introduce how to use RemoteAttribute in MVC to solve this type of verification requirement, and analyze the deficiency of RemoteAttribute and the improvement methods. the source code related to this article here MVC-Remote-Validation.zip 1, RemoteAttribute verification use if you need to fill out the entire form, submit to the background, and then tell the user that, "The user you registered has been occupied. Please change the user name." It is estimated that many users may have to swear. remote Authentication in MVC is implemented through Ajax. That is to say, when you enter the user name, the content you entered will be automatically sent to the background, and the background will return the check result. 1. it is very easy to implement Remote verification. First, you need to have a background method to respond to the verification request, that is, you need to create a Controller. Here we use ValidationController: public class ValidationController: controller {public JsonResult IsEmployeeNameAvailable (string employeeName) {// assume that the existing user is "justrun". if the input name is not justrun, verify if (employeeName! = "Justrun") {return Json (true, JsonRequestBehavior. allowGet);} return Json ("The name 'justrun 'is not available, please try another name. ", JsonRequestBehavior. allowGet) ;}} 2. next we apply RemoteAttribute public class Employee {public int EmpId {get; set;} [DisplayName ("Employee Name")] [Remote ("IsEmployeeNameAvailable ", "Validation")] // use RemoteAttribute to specify the Controller and Action pub to be verified. Lic String EmployeeName {get; set ;}} 3. corresponding View @ using (Html. beginForm () {@ Html. antiForgeryToken () @ Html. validationSummary () <fieldset> <legend> Registration Form </legend> <ol> <li> @ Html. labelFor (m => m. employeeName) @ Html. editorFor (m => m. employeeName) @ Html. validationMessageFor (m => m. employeeName) </li> </ol> <input type = "submit" value = "Register"/> </fieldset>} 4. finally, let's take a look at the verification result MVC-Validation. -Remote can see through firebug that the EmployeeName of the form will be continuously sent to the designated Controller during the form filling process for verification on the Action. 2. RemoteAttribute's limitations it is really great to use RemoteAttribute for remote verification-it will automatically initiate AJAX requests to access the background code for verification. however, once the form is submitted, this verification will not exist. For example, when I use the [Required] Verification label, both the client and the server have the Required verification items. The server can easily determine whether the form data currently submitted to the background is valid through ModelState. IsValid. However, RemoteAttribute is only verified by the client, but not by the server. That is to say, if Javascript is disabled in the user's browser, our Remote check will be useless. Is it very unexpected? When you get in touch with Remote verification, the default one will think it will be the same as other verification labels. Therefore, using RemoteAttribute verification poses certain security risks.