Route Properties

Properties on route classes are populated with data from the URL query string for GET requests, and from form data for POST requests. Properties are populated based on parameters or input fields with matching names.

Only public properties are populated, which allows you to safely define protected and read‑only properties on your class without the potential for web requests to set their values.

Web clients can send any values in HTTP requests. Just because your HTML form does not define an input field with a specified name does not mean a web client cannot forge a request with arbitrary field names. You should expect that any public property on a route class can be overwritten by the web client.

The following attribute types are supported.

Special handling for file input fields

If form data contains file information, such as from an HTML <input type="file">, a temporary file representing this file is created. A String property is populated with a string in the following format.

original_filename.ext;C:\path\to\temporary\file

For example, somename.png;C:\temp\35283f1f-d4d2-456a-b141-ea50054e4e10.

This string can be parsed by the application by treating everything up to the first semicolon character (;) as the file name that was sent by the request, and everything following as the path to the temporary file.

The temporary file is deleted after the HTTP request ends. The application must read or copy the file during the request to retain it.

A StringArray property is populated with multiple of these file‑format strings, in the case of an upload containing multiple files.