CODEWITHSUNDEEP
ajaxasp.net-mvcjson
valrecx
valrecx

Reputation: 469

How to prevent json hijack on mvc

how to prevent json hijack on mvc?

[PreventHijack]
public JsonResult Check(int id)
{
   return Json(id, JsonRequestBehavior.AllowGet);
}

javascript

$.ajax({
   url: "/Controller/Check?id=1",
   type: "post",
   success: function(data) {
   }
})

I don't want anyone to browse this jsonresult through the addressbar. Is it possible to use the antiforgerytoken here?

Upvotes: 1

Views: 980

Answers (1)

Scott Weaver
Scott Weaver

Reputation: 7361

You are explicitly allowing users to browse to the URL with JsonRequestBehavior.AllowGet. If you take that out, .NET will throw an error upon hitting that URL: This request has been blocked because sensitive information could be disclosed to third party web sites when this is used in a GET request

Upvotes: 1

Related Questions