Attribute [Bind(Exclude=“”)] fails to prevent over-posting

Question

What is the best way to prevent MVC 4 over-posting?

According to MS sources, the [Bind] attribute is supposed to be the easiest way to prevent over-posting by preven

Answer 1

If you revert back to manuel model binding, you should not have any problems. If you do not place an input for "IsAdmin" your model will retain its original value. This adds a few lines of extra code but saves a lot of time by not generating not maintaining ViewModels.

[HttpPost]
[ValidateAntiForgeryToken]
public ActionResult Edit(Guid id, FormCollection collection)
{
    var user = db.Users.Find(id);
    if (user != null)
        TryUpdateModel(user);
    else
        return HttpNotFound();
    if (ModelState.IsValid)
    {
        db.SaveChanges();
        return RedirectToAction("Index");
    }
    return View(user);
}