NET 5 onwards, the Compare attribute works without any additional steps being necessary. For further discussion, see this GitHub issue. The Compare attribute is supported when it is applied to the properties of such an object. The workaround is to either manually compare the property values in code, or to create a create a 'wrapper' object for the bound properties (like an InputModel). The Compare attribute does not work as expected when applied to properties of a PageModel in Razor Pages 3.x and earlier.Sets the maximum, and optionally, the minimum number of string characters allowed Note that non-nullable value types such as DateTime and numeric values are treated as required by default and do not need this attribute applied to them Specifies that a value must be provided for this property. Sets the minimum and maximum values of a rangeĬhecks the value against the specified regular expression Sets the minimum number of characters/bytes/items that can be acceptedĮnables client-side validation against a server-side resource, such as a database check to see if a username is already in use Sets the maximum number of characters/bytes/items that can be accepted Used to specify another form field that the value should be compared to for equality Most of these attributes reside in the namespace. The primary building block of the validation framework is a set of attributes that inherit from ValidationAttribute. The key players in the input validation framework are: The MVC framework, on which Razor Pages is built, includes a robust validation framework that works against inbound model properties on the client-side and on the server. However, you should only ever view client-side validation as a courtesy to the user because it is easily circumnavigated. You can validate user input in two places in a web application: in the browser using client-side script or the browser's in-built data type validation and on the server. The default position should be that all user input is to be considered untrusted. Values provided via forms constitute the bulk of user input, but user input also comes in the form of values provided in URLs and cookies. The term 'user input' covers any value that the user has control over. This process is known as input validation. When you allow users to provide values that you then process, you need to ensure that the incoming values are of the expected data type, that they are within the permitted range and that required values are present. Managing Security With ASP.NET Identity.

Restrict data annotations