Preferred Way of Reading the Model Values in Web API and MVC - asp.net-mvc-4

Question

So, There are multiple ways a client can pass values to server. Request Body, Header and/or Cookies.
On the server side these values could be retrieved by ModelBinders, ValueProviders MediaFormatters, FromBody, FromUri, Dependency Inject a component that reads it from current http Context or Read from current HTTP context directly ( I know this is the worst one for unit testing. So, never do that).
The question is how to decide which to be used for what.
What I think is for all the user input use ModelBinder. For anything else, like authentication token in header dont use the model binder but a authentication attribute. Which reads from the header or cookie.
What about the case where you have somthing like a cartId and you are updating the Items in cart, Shipping address, Payment address etc. Now, using DDD Cart must be the root object and Items, shipping address and payment must be the child and each request must receive a cart and the dependent object. But, that would be a really heavy load. So, why not to pass around only cartId and why not to store that cartId in cookie and if we do that. How should we read the value of cartId, use a ModelBinder, Dependency Inject a component that reads it from current http Context or Read from current HTTP context directly ( I know this is the worst one for unit testing. So, never do that)
So, any id that is not an auth token or a session token and is required in the action method. But it is not being passed as an input in request body or query strings. What is the best approach to read parameters like that

Answer 1

What about the case where you have somthing like a cartId and you are
updating the Items in cart, Shipping address, Payment address etc.
Now, using DDD Cart must be the root object and Items, shipping
address and payment must be the child and each request must receive a
cart and the dependent object.
Don't confuse DDD with HTTP/REST. DDD is for your domain. HTTP/REST is for your web resources.
Why not something like this?
add product to the cart
POST /my/carts/1/products { body/model: productId=6&quantity=2 }
update quantity
PUT /my/carts/1/products/6 {body/model: quantity=4 }
...and I have to argue with your DDD design. Shipping and billing addresses are really parts of the Order aggregate, not the Cart aggregate. But I digress...
If you organize your HTTP resources to mimic your DDD aggregates, then you don't need to pass the whole cart in with each request. You can have different user actions call different resources/method combinations to interact with the aggregate. You don't even need to send the cartId in with the body of the request, because it is already in the URL:
[POST("my/carts/{cartId:int}/products")]
public HttpResponseMessage PostProduct(int cartId, CartProductPostModel model)
{
// ensure user owns the cart (based on cookie or authentication info)
// get the cart aggregate based on the cartId,
// add the product to the cart
// tell the client you succeeded by passing back an appropriate response
// 201 Created
// Location: http://www.site.com/my/carts/1/products/6
// note the response does not send back the whole cart, it only tells you
// the new resource was created and where you can access it
}
If you design your HTTP resource URL's RESTfully, then you don't need to pass around any id's in headers, cookies, session, etc, because all of the information you need is already in the request -- either in the URL itself, or in the request body.
Update
So, in our case cartId is not an integer it is a string that actually
has some "/"s (IIS/ASP.net MVC blows up). I know weird but thats how
it is and I can't change it. So, it can't be there as part of url. It
could be part of a query-string. But, to make it inter operate with
someother clients. We are kind of forced to put it on cookie.
Yes you can put it in the URL. You just have to encode it first. So a cart ID like cart/with/slashes ends up like this in the URL:
add product to the cart
POST /my/carts/cart%2fwith%2fslashes/products
update quantity
PUT /my/carts/cart%2fwith%2fslashes/products/6
This will work just fine with either MVC or WebAPI routing without blowing up.
[POST("my/carts/{cartId}/products")]
public HttpResponseMessage PostProduct(string cartId, CartProductPostModel model)
{
// cartId will be "cart/with/slashes", decoded
}