PrismitaLEARN · PRACTICE · GROW

How does model validation work in ASP.NET MVC?

ASP.NET MVC Model Binding & Validation Intermediate 2–3 Yrs3–5 Yrs Conceptual 2 min read

Quick Answer

You annotate the model with validation attributes ([Required], [StringLength], [Range], [EmailAddress]…). During model binding the framework runs those rules and records failures in ModelState. Your action checks ModelState.IsValid; if false, it re-renders the view and asp-validation-for shows the messages. The same attributes also drive unobtrusive client-side validation.

Validation is driven by attributes on the model — Required, StringLength, Range, and so on — plus IValidatableObject for rules that span multiple fields. When the request comes in, model binding fills the parameter and then runs those rules, putting any failures into ModelState against the field name. In the action I check ModelState.IsValid, and if it's not valid I return the same view so the user sees their input and the error messages next to each field. The tag helpers also emit data-val attributes, so jQuery unobtrusive validation checks the same rules in the browser — but that's just UX, the server-side check is the one that actually protects the data. For Web API, the [ApiController] attribute turns an invalid ModelState into a 400 automatically.

The flow:

  1. Attributes on the model/view model express the rules. Custom rules come from a custom ValidationAttribute or by implementing IValidatableObject for cross-field checks.
  2. Model binding maps request values to the parameter and then validates each property, adding errors to ModelState keyed by field name.
  3. The action inspects if (!ModelState.IsValid) return View(model); — server-side validation is the authority.
  4. The view renders asp-validation-for / ValidationMessageFor and asp-validation-summary.
  5. Client side — jQuery Unobtrusive Validation reads data-val-* attributes the tag helpers emit and validates in the browser before submit. This is a convenience; the server still re-checks.

Points interviewers probe: never trust client validation alone; validate the view model, not the entity; [ApiController] in Core auto-returns 400 with the validation problem details so you don't write the IsValid check for APIs.

C# — model + action 
public class RegisterViewModel
{
    [Required, StringLength(80)]
    public string Name { get; set; } = "";

    [Required, EmailAddress]
    public string Email { get; set; } = "";

    [Range(18, 120)]
    public int Age { get; set; }
}

[HttpPost]
public IActionResult Register(RegisterViewModel model)
{
    if (!ModelState.IsValid)
        return View(model);           // re-show with messages

    _users.Create(model);
    TempData["msg"] = "Account created.";
    return RedirectToAction(nameof(Index));
}

Practise the whole thread the way an interviewer walks it — each question builds on the last.

  1. What is ASP.NET MVC?
  2. Explain the ASP.NET MVC request life cycle.
  3. What is routing in ASP.NET MVC?
  4. What is ActionResult in ASP.NET MVC?
  5. What is the difference between ViewBag, ViewData and TempData?
  6. What is a strongly typed view in ASP.NET MVC?
  7. How does model validation work in ASP.NET MVC?You are here
All ASP.NET MVC questions More on Model Binding & Validation