Hello,

​

Thanks for reading and any help you can provide!

​

I have a full stack asp.net core site that users search things and the site returns results from the database and displays them on the screen.

​

The url on this return page is "www.mywebsite/controller/Action?SearchString=SearchItem"

​

The issue I have is if someone manually makes the url "www.mywebsite/controller/Action?SearchString" or "www.mywebsite/controller/Action?SearchString" the site displays all of the items in the database.

​

I have read through documents on Microsoft and stack overflow I know I am missing something. How do I block someone from manually entering "www.mywebsite/controller/Action?SearchString" and have all of the items on my database be displayed? The sit already blocks someone from clicking enter on the search box and having that url pop up and display everything.

​

I am specifically interested in blocking someone manually entering the url's above.

​

Thanks again!