Overposting

  Overposting - I have been asked about ways to prevent overposting by an HR person.  When I asked what they meant by that, they could not elaborate.  Overposting and other terms means multiple things to multiple people.

    I came across an article where someone was responding to overposting and they were referring to it like it was a single term and it was different than my experiences.  The article about overposting was *1*.  They were defining overposting as exposing a public property that is like Secret or Id that someone sees and overwrites on a post event.  The programmers reply to answer with view model or DTO.   Never mind the problem is really a scope problem (Secret should be private) and no one would have seen it or that your Post method should not be written to set/change the Id column.  

    Another overposting happens when:  1) user presses "Save" button after entering but the web page is taking too long to respond and so the user presses the button again to try to ensure it is submitted or 2) in a multi-user environment two clerks are entering data and get the same person's paper form to submit and end up posting the data twice.  The real fix for these two scenarios is to be idempotent (ie. rather than insert twice and create duplicate, check to see if exists, if does then update else insert).   

   The overall the core problem is unknowledgeable asking vague checklist questions that determines knowledge or not. 

REFERENCES

*1* = https://stackoverflow.com/questions/41665523/how-can-i-detect-an-overposting-attack-in-asp-mvc-during-model-binding