ASP.net MVC AntiForgeryToken了AJAX [英] ASP.net MVC AntiForgeryToken over AJAX

问题描述

我目前正在开发的ASP.net MVC应用程序。我使用AJAX.ActionLink提供的记录列表中删除链接，然而，这是非常不安全的。我已经把这样的：

I am currently developing an MVC application in ASP.net. I am using AJAX.ActionLink to provide a delete link in a list of records, however this is very insecure. I have put this:

<AcceptVerbs(HttpVerbs.Post)>

在功能做了删除，从而停止功能由一个URL被称为简单。然而，仍然存在其他安全漏洞的是，如果我是做一个基本的HTML页面与此内容：

Over the function to do the deleting, which stops the function being called simply by a URL. However, the other security hole that still exists is that if i were to make a basic html page with this content:

<form action="http://foo.com/user/delete/260" method="post">
<input type="submit" />
</form>

它仍然是perfoming一个帖子，而是从不同的位置。

It would still be perfoming a post, but from a different location.

是否有可能使用AntiForgeryToken与AJAX ActionLink的？如果是这样，这是一个安全的方法？是否有更多的安全漏洞我还没有实现呢？

Is it possible to use the AntiForgeryToken with an AJAX ActionLink? If so, is this a secure approach? Are there more security holes i haven't realised?

推荐答案

我不知道的AJAX ActionLink的具体，但有可能从WebForms的页面张贴到一个MVC动作与的[AcceptVerbs（HttpVerbs.Post），ValidateAntiForgeryToken] 属性。

I don't know about the AJAX ActionLink specifically, but it is possible from a WebForms page to post to an MVC action with the [AcceptVerbs(HttpVerbs.Post), ValidateAntiForgeryToken] attributes.

您可以使用反射来获得在用于设置用于MVC验证cookie，并匹配表单输入了MVC的方法。

You can use reflection to get at the MVC methods used to set the cookie and matching form input used for the MVC validation.

看到这个答案：<一href="http://stackoverflow.com/questions/1347728/using-an-mvc-htmlhelper-from-a-webform/2553583#2553583">http://stackoverflow.com/questions/1347728/using-an-mvc-htmlhelper-from-a-webform/2553583#2553583

这篇关于ASP.net MVC AntiForgeryToken了AJAX的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！