Preventing CSRF With Ajax

A long while ago I wrote about the potential dangers of Cross-site Request Forgery attacks, also known as CSRF or XSRF. These exploits are a form of confused deputy attack . Screen grab from The Police Academy movie. In that post, I covered how ASP.NET MVC includes a set of anti-forgery helpers to help mitigate such exploits. The helpers include an HTML helper meant to be called in the form that renders a hidden input, and an attribute applied to the controller action to protect. These helpers work great when in a typical HTML form post to an action method scenario. But what if your HTML page posts JSON data to an action instead of posting a form? How do these helpers help in that case? You can try to apply the ValidateAntiForgeryTokenAttribute...(read more) ...