HttpPost vs HttpGet attributes in MVC: Why use HttpPost?

Question

So we have [HttpPost], which is an optional attribute. I understand this restricts the call so it can only be made by an HTTP POST request. My question is why would I want to do this?

Answer 1

Imagine the following:

[HttpGet]
public ActionResult Edit(int id) { ... }

[HttpPost]
public ActionResult Edit(MyEditViewModel myEditViewModel) { ... }

This wouldn't be possible unless the ActionMethodSelectorAttributes HttpGet and HttpPost where used. This makes it really simple to create an edit view. All the action links just points right back to the controller. If the view model validates false, you just pop right back to the edit view again.

I will be bold and say this is best practice when it comes to CRUDish things in ASP.NET MVC.

EDIT:

@TheLight asked what was needed in the view to accomplish the post. It's simply just a form with method POST.

Using Razor, this would look something like this.

@using (Html.BeginForm())
{
    <input type="text" placeholder="Enter email" name="email" />
    <input type="submit" value="Sign Up" />
}

This renders the following HTML:

<form action="/MyController/Edit" method="post">    
    <input type="text" name="email" placeholder="Enter email">
    <input type="submit" value="Sign Up">
</form>

When the form is submitted, it will perform an Http Post request to the controller. The action with the HttpPost attribute will handle the request.

Answer 2

Its so you can have multiple Actions that use the same name, you can use the HttpPost attribute to mark which method gets handled on a Post request like so:

    public ActionResult ContactUs()
    {
        return View();
    }

    [HttpPost]
    public ActionResult ContactUs(ContactUsModel model)
    {
        //do something with model

        return View();
    }

Answer 3

As far as best practices for HttpGet and HttpPost, it is good practice in any web development to use HttpPost for Creates, Updates, and Deletes (data modification). Post is good because they require a form submission, which prevents users from clicking poisoned links(e.g. [https://www.example.com/Delete/1]) in emails, social sites, etc. and changing data inadvertently. If you are basically just Reading data HttpGet works great.

See OWASP for more in-depth security considerations and why the validation token increases security.

Answer 4

This is mainly so that you can have two Actions with the same name, one which is used on GETs and perhaps displays a form for user entry and the other being used on POSTs when the user submits the form displayed by the original GET. If the Actions are not differentiated in this way, an error will occur due to being unable to resolve which Action is intended to handle the request.