Question

I have a controller method for an ajax request that I’m curious as to how I can stop random folks from submitting data to that url. I want to make sure it’s coming from that specific form.

[HttpPost]
public JsonResult DemographicsSave(FormCollection collection)
{   
    return Json("Patient Saved", JsonRequestBehavior.AllowGet);
}

Answer 1

This is a NuGet package created by my friend for just this very purpose and shores up some security “holes” by default. It should save you some time in implementation!

http://nuget.org/packages/ValidationAndAuthenticationByDefault.MVC3

Alternatively you can add to your controller :

[HttpPost]
[ValidateAntiForgeryToken]

Followed by the following in your view:

@Html.AntiForgeryToken()