I\'m just starting out with Entity Framework and I\'m concerned about the ease with which a primary key can be overridden. I know I can protect this model in my controller (
Yes you can, and it should work just fine. Per this blog post by Julie Lerman (who's Microsoft's Entity Framework MVP, so I highly recommend that you read her blog on your journey through EF!):
Entity Framework requires a parameterless constructor in order to materialize objects returned from queries (or loading). I have made this concession in my class but notice that it is a private constructor. So I’m still protecting my class. Nobody can access it. But EF is still able to populate this class when I execute queries. And no, I’m not doing some magic to tell EF to use my public constructor. It really uses the private constructor.