How to pass object as hidden parameter with RedirectToAction?

Question

I have done like this.

public ActionResult GetInfo(SomeModel entity)
{
     ----
     return RedirectToAction("NewAction", "NewController", new System.Web.Routing.RouteValueDictionary(entity));
}

Action which was called

public ActionResult NewAction(SomeModel smodel)
{
     -------
     -------
}

This is working fine but I can see all posted param values on browser address bar, how can I hide these querystring param values in browser.

http://localhost:51545/NewController/NewAction?SurveyID=13&CatID=1&PrimaryLang=1&SurveryName=Test%20Survery&EnableMultiLang=False&IsActive=False

Any Help will be appreciated.

Answer 1

In your case instead of using RouteValueDictionary and passing model from querystring try TempData(because when we use RedirectToAction it will make a new http request and object routes will be shown in url so its not a good approach to display sensitive data in url).

Use TempData as shown :-

public ActionResult GetInfo(SomeModel entity)
{
  ----
  TempData["entity"] = entity; //put it inside TempData here
  return RedirectToAction("NewAction", "NewController");
}

public ActionResult NewAction()
{
   SomeModel smodel = new SomeModel();
   if(TempData["entity"] != null){
   smodel = (SomeModel)TempData["entity"];  //retrieve TempData values here
   }
   -------
   -------
}

The benefit of using TempData here is that it will retain its value for one redirect and moreover model will be privately transported to another controller action and once you read data from TempData its data will be disposed automatically and if you want to retain TempData value after reading it then use TempData.keep("entity").

---

OR

If your Views are in a same Controller then this a simple solution for your problem :

public ActionResult GetInfo(SomeModel entity)
{
  ----
  return NewAction(entity);
}

public ActionResult NewAction(SomeModel smodel)
{
   -------
   -------
  return View("NewAction",smodel)
}

As Correctly Commented by @Chips_100 so i m including it here :- The first solution will do a real redirect (302) which will update the URL in the users browser. The second solution will give the desired result while keeping the original URL in the address bar.