POST 提交的表单显示 URL 中的值。难道不应该隐藏它们吗？
当我使用 HttpPost 时，表单值不应该隐藏在我的 URL 中吗？
这是我用来生成付款确认页面的 Razor 代码：
@using (Html.BeginForm("Index", "Checkout", new { amount = Model.PackageCost, currency = "$", itemDescription = Model.PackageDescriptor, type = "digital" }, FormMethod.Post))
{
<input type="submit" value="Confirmar" class="btn primary frmsubmit" />
}
在我的 HTML 中，生成了以下内容：
<form action="/Checkout?amount=50&currency=%24&itemDescription=Paquete%20Gold50%20%7C%2050%24%20(59%20lances)&type=digital" method="post">
<input type="submit" value="Confirmar" class="btn primary frmsubmit" />
</form>
当我单击“确认”按钮提交表单时，这是我引导至的 URL：
http://localhost:5868/Checkout?amount=50¤cy=%24&itemDescription=Paquete%20Gold50%20%7C%2050%24%20%2859%20lances%29&type=digital
那么结果是什么？如果是 POST 表单，为什么值不被隐藏？
When I use HttpPost shouldn't the form values be hidden in my URL?
Here's the Razor code I'm using to generate a confirm page for payment:
@using (Html.BeginForm("Index", "Checkout", new { amount = Model.PackageCost, currency = "$", itemDescription = Model.PackageDescriptor, type = "digital" }, FormMethod.Post))
{
<input type="submit" value="Confirmar" class="btn primary frmsubmit" />
}
In my HTML, this is generated:
<form action="/Checkout?amount=50¤cy=%24&itemDescription=Paquete%20Gold50%20%7C%2050%24%20(59%20lances)&type=digital" method="post">
<input type="submit" value="Confirmar" class="btn primary frmsubmit" />
</form>
And when I click the Confirm button to submit the form, this is the URL I'm lead to:
http://localhost:5868/Checkout?amount=50¤cy=%24&itemDescription=Paquete%20Gold50%20%7C%2050%24%20%2859%20lances%29&type=digital
So what gives? Why aren't the values being hidden if it's a POST form?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
因为这些不是表单值，而是路由值。表单值是
标记的值。我假设您不需要任何路由值（省略第三个参数），而是创建具有适当默认值的
标记。如果普通用户不应该看到它们，请使用（这显然不是安全功能）。您还应该使用防请求伪造令牌。
Because those are not the form values, but the route values. The form values are the values of the
<input >tags.I assume you don't want any route values(leave out the third parameter) and instead create
<input ...>tags with an appropriate default value. If the normal user should not see them use<input type="hidden">(This is obviously not a security feature).You should also use anti request forgery tokens.