CODEWITHSUNDEEP
c#asp.netjsonasp.net-mvc
Rahul
Rahul

Reputation: 2307

Why there is need to use JsonRequestBehavior if we already have [HttpPost]?

In ASP.NET MVC we are having option to secure our Controller's action by using HTTPGET/HTTPPost. And for Json request there is one more option given JsonRequestBehavior for security.

Where JsonRequestBehavior having two options:

public enum JsonRequestBehavior
    {
        AllowGet = 0,
        DenyGet = 1,
    }

My question is just for the clearance on why there is JsonRequestBehavior.DenyGet if we can use HttpPost?

Upvotes: 0

Views: 2427

Answers (1)

Daniel Hoffmann-Mitscherling
Daniel Hoffmann-Mitscherling

Reputation: 2379

DenyGet is the default setting set by MVC to protect you against a specific JSON request attack that returns data using HTTP GET.

You need to manually decide to add AllowGet, which forces you to consider the data you are exposing over the HTTP GET method.

For a detailed explanation you can read this (slightly dated) post: http://haacked.com/archive/2009/06/25/json-hijacking.aspx/

Upvotes: 3

Related Questions