Question: I'm having a little understanding my programmers' reasoning regarding a password reset feature. Can somebody please tell me which of the following is more secure, or if they are equal?

Option 1: The user is sent an email with the following:

```
Url: http://mysite/reset/user%mail.com

CODE: 57583

```

The user is then taken to a page where they must manually enter the code, but the email is already populated on the web form.

Option 2: The user is sent the following email:

```
URL: http://mysite/reset/user%mail.com&code=57583

```

I'm not a programmer and sorry if this is a simple question or if my 2nd url is not formatted properly, my point here is that in example 1, the user must manually enter the code, and in the 2nd example the form is pre-populated with the code.

So would these be effectively just as secure as the other, or does one have a significant security advantage?

Answer: 
You must create Properties in your model

```
public class Person
{
    public string Name { get; set; }
    public int Age { get; set; }
}

```

instead of

```
public class Person
{
    public string Name;
    public int Age;
}

```

ASP.net MVC only binds properties.
Why is your model an `object` in the `Get` method? That may be what's confusing the model binder. That also looks like why it throws an exception on page load when you change them to `EditorFor`s

Try strong typing it:

```
[HttpGet]
public ActionResult Index()
{
    Person model = new Person {Name = "foo", Age = 44};
    return View(model);
}

```