ModelState.IsValid does not exclude required property

Question

Im trying to exclude a required property(Password) so the modelstate dont validate that property, but for some reason it still validate even when i try to exclude it.

Controller:

    [Authorize, AcceptVerbs(HttpVerbs.Post)]
    public ActionResult _Edit(int id, [Bind(Exclude = "Password")]FormCollection collection)
    {
        var user = Proxy.GetUser(id);

        TryUpdateModel(user, null, null, new[]{"Password"});

        if(!ModelState.IsValid)
            return PartialView(user);

        Proxy.UpdateUser(user);
    }

View:

   ...
   <tr>
       <td class="label">
           <label class="row_description" for="Password"><%= S._("Password")%></label>
       </td>
       <td>
           <%= Html.Password("Password", null, new { @class = "row_input" })%>
           <%= Html.ValidationMessage("Password", "*")%>
       </td>
   </tr>

User(using dataannotation):

[Required]
public string Password { get; set; }

Im using VS2008, MVC2, firefox

Maybe im just tired and can't see it. Any help is appreciated

Answer 1

I am currently experiencing a similar issue with MVC3.

Despite [Bind(Exclude = "Password")] in my Action, ModelState.IsValid still returns false.

I noticed that TryUpdateModel(user, null, null, new string[]{"Password"}); was successfully updating the model; however still returning false. I then found out (somewhere on stackoverflow, apologies for not having the link) that TryUpdateModel actually returns ModelState.IsValid.

Thus, the issue is not with TryUpdateModel, but with ModelState.IsValid.

NB: this also means that you do not need to verify this twice... you can use this code:

if (!TryUpdateModel(user, null, null, new string[]{"Password"}))
    return PartialView(user);

The issue thus appears as if ModelState is still validating properties that have been excluded from your FormCollection.

I was able to overcome this by removing the field from ModelState prior to calling TryUpdateModel:

ModelState.Remove("Password");

Note that TryUpdateModel still requires the list of properties to exclude from the update as per the above code.

Answer 2

I had success using the following method within ASP .NET MVC 2

TryUpdateModel(user);
ModelState.Remove("Password");
if (!ModelState.IsValid) return PartialView(user);

To keep the TryUpdate from binding to certain model properties you can create an inclusion template such as the one below:

public interface IUserValidateBindable
{
    string UserId { get; set; }
}

public class User : IUserValidateBindable
{
    [Required]
    public string UserId { get; set; }
    [Required]
    public string Password { get; set; }
}

The update the TryUpodateModel call as follows:

TryUpdateModel<IUserValidateBindable>(user);