All Change! ValidateInputAttribute and SkipRequestValidation

I recently blogged about the new Exclude feature of ValidateInputAttribute in ASP.NET MVC 3 (Beta 2).  Well as with most early adopter types I've been shafted!  Well not really but things have changed slightly and it makes my last post slightly redundant.

Let me clarify a bit.  The Exclude property no longer exists.  It has instead been replaced with a new attribute SkipRequestValidation.  This is a per-property attribute that lets you specify what properties should be excluded.  This has the effect of pushing the validation flag down to the model rather than on the controller.  This make a lot more sense especially in a controller/solution that has many actions accepting the model.  So what changes?  Lets take a look at our old code.

First things first the controller no longer need the ValidateInput attribute and goes back to the old "thinner" version of itself,

public class HomeController : Controller
{
    public ActionResult Post()
    {
        return View();
    }

    [HttpPost]
    public ActionResult Post(ForumPost post)
    {
        return View();
    }
}

We then need to mark the Bodyt property of our ForumPost model to skip validation,

public class ForumPost
{
    public string Subject { get; set; }
    
    [SkipRequestValidation]
    public string Body { get; set; }
}

Thats it.  To be honest this feels like a much neater solution.  It feels more a solution rather than a tacked on property that was added to cater for a specific case.

ASP.NET MVC 3 RC1 is out now - read more here, and get it here.