ASP.NET MVC Tip #46 – Don’t use Delete Links because they create Security Holes

I created a sample ASP.NET MVC application that I plan to post at the http://ww.ASP.net/mvc website. While the application was being code reviewed by the ASP.NET MVC Feature team, a surprising objection surfaced. The application is extremely simple. It contains a view that renders a list of database records. Next to each record, there is an Edit link and a Delete link (see Figure 1). Pretty standard stuff. Or, so I thought? Figure 1 ? A Grid of database records Here?s the objection. You should not use a link for deleting a record. Using a Delete link opens up a security hole. The Security Objection In theory, someone could send an email to you that contains an image. The image could be embedded in the message with the following tag: <img...(read more) ...