Home/ Questions/Q 709643
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-05-14T04:31:33+00:00

I am currently developing an MVC application in ASP.net. I am using AJAX.ActionLink to

  • 0

I am currently developing an MVC application in ASP.net. I am using AJAX.ActionLink to provide a delete link in a list of records, however this is very insecure. I have put this:

<AcceptVerbs(HttpVerbs.Post)>

Over the function to do the deleting, which stops the function being called simply by a URL. However, the other security hole that still exists is that if i were to make a basic html page with this content:

<form action="http://foo.com/user/delete/260" method="post">
<input type="submit" />
</form>

It would still be perfoming a post, but from a different location.

Is it possible to use the AntiForgeryToken with an AJAX ActionLink? If so, is this a secure approach? Are there more security holes i haven’t realised?

Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Editorial Team

    I don’t know about the AJAX ActionLink specifically, but it is possible from a WebForms page to post to an MVC action with the [AcceptVerbs(HttpVerbs.Post), ValidateAntiForgeryToken] attributes.

    You can use reflection to get at the MVC methods used to set the cookie and matching form input used for the MVC validation.

    See this answer: Using an MVC HtmlHelper from a WebForm

    • 0