ASP.NET Core MVC · Models

Model Validation

Users mistype emails, leave fields empty and enter impossible ages. ShopSmart’s registration form must catch that, show friendly messages next to the right fields, and keep what the user already typed. MVC’s validation system does most of the work.

Intermediate 7 min Lesson 14 of 42Examples target .NET 9.

Before you start:Model Binding

0/42 in ASP.NET Core MVC

On this page · 7 min · Intermediate

Interview questions

In simple words#

Validation is the exam invigilator checking the form: required fields filled, email looks right, age in range — before anything is saved.

ModelState.IsValid: True if all rules passed.
Client + server: Browser checks for UX, server checks for safety.
asp-validation-for: Shows the error next to the field.

Learning objectives#

Check ModelState.IsValid after binding
Redisplay a form with errors and the user’s input
Show messages with asp-validation-for and asp-validation-summary
Add business-rule errors with ModelState.AddModelError

Explanation#

Validation runs automatically during model binding: data annotation attributes on the input model ([Required], [EmailAddress], [Range]) are checked, and conversion failures are recorded too. The result is in ModelState.

In the POST action, check if (!ModelState.IsValid) return View(input); — the same view is rendered again with the user’s values and the error messages.

Tag helpers display errors: <span asp-validation-for="Email"></span> next to a field, and <div asp-validation-summary="ModelOnly"></div> for errors that are not tied to a field.

Some rules need code: “this email is already registered”. Add them with ModelState.AddModelError(nameof(input.Email), "…") before checking IsValid. Use an empty key for form-level errors.

On success, redirect (Post/Redirect/Get) so a browser refresh does not submit the form twice. With the jQuery validation scripts (_ValidationScriptsPartial), the same rules also run in the browser — but the server check is the one that counts.

Syntax#

C# Illustrative

1[HttpPost, ValidateAntiForgeryToken]
2public IActionResult Register(RegisterInput input)
3{
4    if (!ModelState.IsValid) return View(input);   // show the form again with messages
5    // … save …
6    return RedirectToAction(nameof(Welcome));      // Post/Redirect/Get
7}

Code example: A registration form with server-side validation#

C#Controllers/AccountController.cs Illustrative

1// Program.cs
2using System.Net;
3using System.Text.RegularExpressions;
4

5var builder = WebApplication.CreateBuilder(args);
6builder.Logging.ClearProviders();                                  // keep the demo output clean
7builder.Services.AddControllersWithViews();
8var app = builder.Build();
9app.MapDefaultControllerRoute();
10app.Urls.Add("http://127.0.0.1:5112");
11await app.StartAsync();
12

13// The client keeps cookies, like a browser, so the antiforgery token check passes
14var handler = new HttpClientHandler { AllowAutoRedirect = false };
15using var http = new HttpClient(handler) { BaseAddress = new Uri("http://127.0.0.1:5112") };
16var form = await http.GetStringAsync("/Account/Register");
17var token = Regex.Match(form, "name=\"__RequestVerificationToken\" type=\"hidden\" value=\"([^\"]+)\"").Groups[1].Value;
18

19async Task Submit(string name, string email, string age)
20{
21    var response = await http.PostAsync("/Account/Register", new FormUrlEncodedContent(
22        [new("Name", name), new("Email", email), new("Age", age), new("__RequestVerificationToken", token)]));
23    Console.WriteLine(
quot;POST Name='{name}' Email='{email}' Age='{age}' -> {(int)response.StatusCode} {response.Headers.Location}".TrimEnd());
24    var html = await response.Content.ReadAsStringAsync();
25    foreach (Match m in Regex.Matches(html, "data-valmsg-for=\"(\\w+)\"[^>]*>([^<]+)<"))
26        Console.WriteLine(
quot;  {m.Groups[1].Value}: {WebUtility.HtmlDecode(m.Groups[2].Value)}");
27}
28await Submit("", "not-an-email", "15");
29await Submit("Asha", "asha@example.com", "abc");
30await Submit("Asha", "asha@shopsmart.example", "28");
31await app.StopAsync();
32

33// Models/RegisterInput.cs
34using System.ComponentModel.DataAnnotations;
35

36public class RegisterInput
37{
38    [Required, StringLength(40, MinimumLength = 2)]
39    public string Name { get; set; } = "";
40

41    [Required, EmailAddress]
42    public string Email { get; set; } = "";
43

44    [Range(18, 120, ErrorMessage = "You must be at least 18.")]
45    public int Age { get; set; }
46}
47

48// Controllers/AccountController.cs
49using Microsoft.AspNetCore.Mvc;
50

51public class AccountController : Controller
52{
53    [HttpGet]
54    public IActionResult Register() => View(new RegisterInput());
55

56    [HttpPost, ValidateAntiForgeryToken]
57    public IActionResult Register(RegisterInput input)
58    {
59        if (input.Email.EndsWith("@example.com", StringComparison.OrdinalIgnoreCase))   // a rule that needs code
60            ModelState.AddModelError(nameof(input.Email), "Please use your real email address.");
61

62        if (!ModelState.IsValid) return View(input);         // same view, with messages and typed values
63

64        return RedirectToAction(nameof(Welcome), new { name = input.Name });
65    }
66

67    public IActionResult Welcome(string name) => Content(
quot;Welcome, {name}!");
68}
69

70@* Views/Account/Register.cshtml *@
71@model RegisterInput
72<form asp-action="Register" method="post">
73    <label asp-for="Name"></label> <input asp-for="Name" />
74    <span asp-validation-for="Name"></span>
75    <label asp-for="Email"></label> <input asp-for="Email" />
76    <span asp-validation-for="Email"></span>
77    <label asp-for="Age"></label> <input asp-for="Age" />
78    <span asp-validation-for="Age"></span>
79    <button>Create account</button>
80</form>

Expected output

POST Name='' Email='not-an-email' Age='15' -> 200
  Name: The Name field is required.
  Email: The Email field is not a valid e-mail address.
  Age: You must be at least 18.
POST Name='Asha' Email='asha@example.com' Age='abc' -> 200
  Email: Please use your real email address.
  Age: The value 'abc' is not valid for Age.
POST Name='Asha' Email='asha@shopsmart.example' Age='28' -> 302 /Account/Welcome?name=Asha

This example is illustrative. Copy or download it and run it in your own environment; the expected output is shown above.

Step-by-step explanation#

The GET request renders the form; the form tag helper adds a hidden antiforgery token, which the client sends back.
The first POST breaks three rules, so ModelState is invalid and the form is shown again with three messages.
In the second POST, “abc” cannot be converted to int, and the example.com address fails the custom rule.
The third POST is valid, so the action redirects (302) to Welcome — Post/Redirect/Get.
Each <span asp-validation-for> shows the message for its own field.

Real-world use case#

ShopSmart validates registration, address, checkout and product-editing forms this way, adding code rules such as “email already registered” or “coupon expired” with AddModelError.

Common mistakes#

Forgetting to check ModelState.IsValid

Binding never throws for bad input. Without the check, invalid data is saved.

Redirecting on errors

Redirecting after a failed POST loses the user’s input and the messages. Return View(input) instead.

Client-side validation only

Browser checks can be bypassed in seconds. The server must validate every request.

Best practices#

Validate on the server; add client scripts for UX
Return View(input) on errors, redirect on success
Use AddModelError for business rules
[ValidateAntiForgeryToken] on every form POST

Remember this#

Bind → validate → ModelState.IsValid.

Invalid → return View(input). Valid → redirect.

asp-validation-for shows the field’s message.

Practice exercise#

Your task: Add a ConfirmEmail field that must match Email, and a form-level error “Registrations are closed on Sundays” when DateTime.Today is a Sunday (shown with asp-validation-summary="ModelOnly").

Need a hint?

[Compare(nameof(Email))] for the field; ModelState.AddModelError(string.Empty, "…") for the form-level error.

Show solution

C# Illustrative

1// Models/RegisterInput.cs
2using System.ComponentModel.DataAnnotations;
3

4public class RegisterInput
5{
6    [Required, EmailAddress] public string Email { get; set; } = "";
7    [Compare(nameof(Email), ErrorMessage = "The emails do not match.")] public string ConfirmEmail { get; set; } = "";
8}
9

10// Controllers/AccountController.cs
11using Microsoft.AspNetCore.Mvc;
12

13public class AccountController : Controller
14{
15    [HttpPost, ValidateAntiForgeryToken]
16    public IActionResult Register(RegisterInput input)
17    {
18        if (DateTime.Today.DayOfWeek == DayOfWeek.Sunday)
19            ModelState.AddModelError(string.Empty, "Registrations are closed on Sundays.");
20        if (!ModelState.IsValid) return View(input);
21        return RedirectToAction("Index", "Home");
22    }
23}
24

25@* Views/Account/Register.cshtml *@
26@model RegisterInput
27<form asp-action="Register" method="post">
28    <div asp-validation-summary="ModelOnly"></div>
29    <input asp-for="Email" /> <span asp-validation-for="Email"></span>
30    <input asp-for="ConfirmEmail" /> <span asp-validation-for="ConfirmEmail"></span>
31    <button>Create account</button>
32</form>

Mini quiz#

Model Validation quizMultiple choice Question 1 of 3

What should a POST action do when ModelState is invalid?

Score so far: 0/0

Want more? Practise all ASP.NET Core MVC MCQs · ASP.NET Core MVC interview questions

My notes#

Saved in this browser.

Progress is saved in this browser. Sign in to sync.

On this page

Related tutorials

Interview questions

In simple words#

Learning objectives#

Explanation#

Syntax#

Code example: A registration form with server-side validation#

Step-by-step explanation#

Real-world use case#

Common mistakes#

Best practices#

Remember this#

Practice exercise#

Mini quiz#

Related topics#

My notes#