使用CCW的ASP.NET MVC3 AntiForgery令牌

Question

I have some legacy application that are currently posting basic information to a MVC3 form. I would like to seperate that out to a GET and pass the values in the querystring. Easy enough. However, I would like to add an anti-forgery token to the request. First of all, does this seem like a good option? Second, are there any examples of implementing such functionality from a non-MVC3 module to an MVC3 form?

My other alternative would be to encrypt the querystring.

Answer 1

The Anti-Forgery Token as implemented by ASP.NET is meant as a mechanism to prevent CSRF (that corss-site-request-forgery) and does only work with HTTP POST .

Since you are implementing a GET based "API" this Token won't work (BEWARE of limits for example on the length of a querystring).

I am not sure what exactly your goal is... Depending on your goal the solution is encrypting or signing the querystring or both.

Answer 2

You can every post you want to this mvc3 action. You only have to make sure your postdata matches the serverside object. And Yes you have to use an antiforgery token for safety.

in javascript you can make for example a post like this with jQuery. As you can see I don't use the form, but just some javascript code. Mvc can perfectly handle this.

$.ajax({
    type: 'POST',
    url: urlToYourMvcAction,
    data: {
        name: 'John Doe',
        age: 25
    }, 
    success: successCalback,
    error: errorCallback);

public class Person
{
    public int Id { get; set; }
    public string Name { get; ;set }
    public int Age { get; set; }
}

public class PersonController : Controller
{
    [HttpPost]
    public ActionResult Add(Person person)
    {
          //Your code
    }
}

You can easily make the same post request with the c# WebClient object in your legacy application. You can use fiddler or the developer tools to inspect the request and pass in the correct parameters needed to make the post.

Oh and using a get request can give you trouble when the requests are getting bigger. Posts are ment to sent data to the server. Gets are meant for getting data from the server.