How to prevent partial view direct access from url in asp.net mvc core?

You can create an annotation for your controller action that will prevent users from accessing it directly. Note that the following should work whether the request is coming from ajax or not (could just be calling out to an action to return a partial view via html helpers):

[AttributeUsage(AttributeTargets.Class | AttributeTargets.Method)]
public class NoDirectAccessAttribute : ActionFilterAttribute
{
    public override void OnActionExecuting(ActionExecutingContext filterContext)
    {
        if (filterContext.HttpContext.Request.UrlReferrer == null ||
                    filterContext.HttpContext.Request.Url.Host != filterContext.HttpContext.Request.UrlReferrer.Host)
            {
            filterContext.Result = new RedirectToRouteResult(new
                           RouteValueDictionary(new { controller = "Home", action = "Index", area = "" })); 
        }
    }
}

then annotate your controller action with it as follows:

[HttpPost]
[NoDirectAccess]
public IActionResult Search(ListNSearchModel modelMain)
{ 
     return PartialView();     
}

The X-Requested-With header returns a string that indicates whether it's an Ajax request or not. An Ajax request will have this header set to XMLHttpRequest. This header value won't be present for normal GET and POST requests (non-Ajax requests).

So you could just write attribute like:

public class AjaxOnlyAttribute : ActionMethodSelectorAttribute
{
    public override bool IsValidForRequest(RouteContext routeContext, ActionDescriptor actionDescriptor)
    {
        if (routeContext.HttpContext.Request.Headers != null &&
          routeContext.HttpContext.Request.Headers.ContainsKey("X-Requested-With") &&
          routeContext.HttpContext.Request.Headers.TryGetValue("X-Requested-With", out StringValues requestedWithHeader))
        {
            if (requestedWithHeader.Contains("XMLHttpRequest"))
            {
                return true;
            }
        }

        return false;
    }
}

Then use that like :

[AjaxOnlyAttribute]
public IActionResult Search()
{

    return PartialView();
}

Or you can directly check that in specific action :

string method = HttpContext.Request.Method;

string requestedWith =
    HttpContext.Request.Headers["X-Requested-With"];

if (method == "POST")
{
    if (requestedWith == "XMLHttpRequest")
    {
        // code goes here
    }
}

Just add the [ChildActionOnly] above your Action and should prevent user from accesing directly.

**[ChildActionOnly]**
[HttpPost]
public IActionResult Search(ListNSearchModel modelMain)
{ //....some logic...
 return PartialView();     
}