Question

Say I’ve got a method in c# MVC to send email with ajax, like:

public class mailController : Controller {

        SmtpClient mailserver = new SmtpClient("smtp.foo.com");

        public string send(string from, string to, string subject = "", string body = "", string cc = "", string bcc = "") {
            MailMessage message = new MailMessage(from, to, subject, body);
            if (cc.Length > 0) {
                message.CC.Add(cc);
            }
            if (bcc.Length > 0) {
                message.Bcc.Add(bcc);
            }
            mailserver.Send(message);
            return "MessageSent";
        }
    }

Is there anything I can do to make this more secure? I mean, as it stands anyone can type the relevant info into their address bar. http://www.foo.com/mail/send?from=etc If I want to use this for form submission, I can’t password protect it, or I’d have to use that in the javascript, which is easy to find. I considered setting a cookie and using that as authentication, but that only goes so far. Is there a standard procedure for protecting ajax methods?

Answer 1

You need to validate on the server that the parameters are what you want them to be.