asp.net mvc - Most effective method of protecting an entity ID when posting back from a view -

edit - quick edit, start off clear question! i'm asking is, effective way of protecting entity identifiers when posting view?

i've been thinking ways protect id on post when editing view model. let's take example entity

public class post {     public int id { get; set; }     public string title { get; set; }     public string content { get; set; } } 

and corresponding view model:

public class postviewmodel {     public int id { get; set; }     public string title { get; set; }     public string content { get; set; } } 

now, when pass view model view allows user edit it, i'm going doing this:

public actionresult editpost(postviewmodel viewmodel) {     post post = database.posts.single(p => p.id.equals(viewmodel.id));     post.title = viewmodel.title;     post.content = viewmodel.content;     database.entry(post).state = system.data.entitystate.modified;     database.savechanges();      return view(viewmodel); } 

or maybe pass id through parameter list this:

public actionresult editpost(int postid, postviewmodel viewmodel) {     post post = database.posts.single(p => p.id.equals(postid));     // , rest } 

either way, need return identifier entity we're updating along post data. how make sure entity updated 1 intended?

i suppose validate whether user has sufficient access update entity... if user's account becomes compromised, , random hacker starts injecting random ids using account? updating sorts of posts @ random.

having complex (like guid) identifier recommended entities, make guessing lot harder, makes nice , friendly urls bit intimidating average user, having pass around when viewing post example.

how best of both worlds here? keeping clean urls, protecting our entities injection attacks?

this direct reference attack, , according oswap recommendations, can either

• obfuscate id swapping guid , holding mapping in memory/session
• hold reference item in session , make sure same comes back

the way tackle attribute, haven't code hand need like

decorate action attribute on gets, attribute clears item list session pull item db store items id in session item  decorate post action attribute     attribute makes sure modelstate valid first (saves double validating) attribute looks in session id attribute checks id against stored value if id matches, action can continue if id doesn't match, entry made in modelstate 

using sort of methodolgy, can protect against fiddling ids in tools burpsuite or using console mode of browser flip hidden fields.

also, starter process, ensure item doesnt blindly db, first ensures person can item, ie. belongs datasets etc etc