these params still could be added query string

[kongmengfei]

althrough i use your attr on my controller action, it still could be requested by adding params to query string. how to prevent this?