How to pass an object as a hidden parameter using RedirectToAction?

Question

I did like this.

public ActionResult GetInfo(SomeModel entity) { ---- return RedirectToAction("NewAction", "NewController", new System.Web.Routing.RouteValueDictionary(entity)); } 

Action that was triggered

 public ActionResult NewAction(SomeModel smodel) { ------- ------- } 

This works fine, but I can see all the published parameter values ​​in the address bar of the browser, how can I hide these parameter values ​​of the request in the browser.

 http://localhost:51545/NewController/NewAction?SurveyID=13&CatID=1&PrimaryLang=1&SurveryName=Test%20Survery&EnableMultiLang=False&IsActive=False 

Any help would be appreciated.

Answer 1

In your case, instead of using RouteValueDictionary and passing the model from querystring, try TempData (because when we use RedirectToAction, it will make a new HTTP request, and the routes of the objects will be shown in the URL, so its not a good approach to display sensitive data in the url).

Use TempData as shown: -

 public ActionResult GetInfo(SomeModel entity) { ---- TempData["entity"] = entity; //put it inside TempData here return RedirectToAction("NewAction", "NewController"); } public ActionResult NewAction() { SomeModel smodel = new SomeModel(); if(TempData["entity"] != null){ smodel = (SomeModel)TempData["entity"]; //retrieve TempData values here } ------- ------- } 

The advantage of using TempData is that it will retain its value for one call forwarding, and in addition, the model will be privately transferred to another controller action, and after you read the data from TempData , its data will be deleted automatically, and if you want to keep the TempData value after reading it, then use TempData.keep("entity") .

---

OR

If your views are in the same controller, then this is a simple solution to your problem:

 public ActionResult GetInfo(SomeModel entity) { ---- return NewAction(entity); } public ActionResult NewAction(SomeModel smodel) { ------- ------- return View("NewAction",smodel) } 

As @ Chips_100 comments correctly, so I include it here: - The first solution will be to do a real redirect (302), which will update the URL in the users browser. The second solution will give the desired result by storing the original URL in the address bar.