Force paste as plain text in an ASP.NET Core rich text editor

Pasted content brings its own fonts, colours and sizes, and a page of pasted articles ends up looking like a ransom note. If your site has a strict look, or the field is only meant to hold words, keep the text and drop everything else.

The setting

<richtextbox name="Body"
             toolbar="default"
             height="300px"
             paste-mode="Text"></richtextbox>

Whatever people copy, from Word, a web page or an email, arrives as plain text. They can then apply your site's headings and styles with the toolbar.

When to use which

Use	When
`paste-mode="Text"`	Comments, short notes, and sites with a strict design
`paste-mode="Auto"`	General writing, where lists and tables should survive
`paste-mode="Word"`	People regularly paste from Word and need the structure
`paste-mode="Disabled"`	Exams and forms where copying in is not allowed

A softer alternative

Often the real problem is fonts and colours, not lists. Keep Auto, and let your stylesheet decide the look of content on the published page. Then give people the removeformat button, so they can clear the formatting from what they pasted:

<richtextbox name="Body"
             toolbar="{bold,italic}|{removeformat}|{insertlink}|{undo,redo}"></richtextbox>

This does not protect your server

paste-mode changes what the editor does in the browser. A request sent by hand can still contain anything, so clean the HTML on the server whichever mode you pick. And Disabled does not stop a determined person from retyping or from using developer tools. It is a guide for honest users.