Different Parameter Binding Priority For GET And POST?

Given this route:

routes.MapRoute("home", "{action}/{id}",
new { controller = "home", action = "index", id = UrlParameter.Optional });

...and this action:

public ActionResult Hi(string id) {
return Content("hello, id: " + id);
}

Question #1

What is the response for:

[URL]

Question #2

What is the response for:

[URL]

Content-Length: 4

Content-Type: application/x-www-form-urlencoded

id=3

I believe this is a bug and the route value should always have precedence, since the URL is what identifies a resource. If you write a POST, PUT or DELETE action you expect the id coming from the URL, not from the body of the request. This could cause changes to a different resource, and can be exploited by malicious users.

After doing some research found that the issue is the default ValueProviderFactory registration order, where FormValueProviderFactory comes before RouteDataValueProviderFactory. Instead of messing with the order I created a CustomModelBinderAttribute:

[code]....