Security concerns when using Html.Action to call [ChildActionOnly] action method

Question

I have the following action method inside asp.net mvc5, which i define as ChildActionOnly:-

[ChildActionOnly]
public ActionResult GetChildRecords(int customerid)

and i am calling it as follow, within my view:-

<div>@Html.Action("GetChildRecords", "Customer", new {customerid = Model.CustomerID})</div>

but i have the following questions:-

1. do i need to add [Authorize] annotation before my child action method ? or i can be sure that since its parent is being authorized, so the child action method will be authorized also ?

2. can users or hackers directly calls a ChildActionOnly directly ?

3. could users or hackers modify the Html.Action parameters ?, for example to pass different customerid in the below html:-

@Html.Action("GetChildRecords", "Customer", new {customerid = Model.CustomerID})

?

Answer 1

The essence of the attribute [ChildActionOnly] is to ensure that it is only called using Action or RenderAction and can't be called directly from the browser.

For question 1: If the calling action already has the [Authorize] attribute, you need not worry

For question 2: hackers (or whoever) can't directly access it.

For question 3: since they can't directly call the action, i'm not sure its something to worry about. But verify at the server side at all times for whatever input you are getting (forms, query string etc).