From 627e11668c3b5e0e561b886ee9889067620e0015 Mon Sep 17 00:00:00 2001 From: Rick Anderson <3605364+Rick-Anderson@users.noreply.github.com> Date: Fri, 3 Dec 2021 13:08:39 -1000 Subject: [PATCH] Update first-web-api.md (#24193) --- aspnetcore/tutorials/first-web-api.md | 1 + 1 file changed, 1 insertion(+) diff --git a/aspnetcore/tutorials/first-web-api.md b/aspnetcore/tutorials/first-web-api.md index 4ce94555c3..4360721951 100644 --- a/aspnetcore/tutorials/first-web-api.md +++ b/aspnetcore/tutorials/first-web-api.md @@ -568,6 +568,7 @@ Date: Tue, 07 Sep 2021 21:43:00 GMT Server: Kestrel ``` + ## Prevent over-posting Currently the sample app exposes the entire `TodoItem` object. Production apps typically limit the data that's input and returned using a subset of the model. There are multiple reasons behind this, and security is a major one. The subset of a model is usually referred to as a Data Transfer Object (DTO), input model, or view model. **DTO** is used in this tutorial.