Databases
StackOverflow2013
Postsdbo
POIs a good practice to avoid CSRF doing this? (ASP.NET MVC 3)
 

Note that there are some explanatory texts on larger screens.

plurals
  1. POIs a good practice to avoid CSRF doing this? (ASP.NET MVC 3)
    primarykey
    data
    text
    <p>I have one question about the use of AntiForgeryToken provided by MVC 3.</p> <p>I will try to explain my idea.</p> <p>The basic idea is an Ajax button to "mark as favorite" one (or more) item from a Catalog. So I have a grid with the entire list of items, and each of this items has a button to make as favorite.</p> <p>Well... my idea implementation is this:</p> <p>When the user push the favorite button, this send a GET request to the server to retrieve a partialView with AntiForgeryToken (all of this is transparent to the user because happen on the background).</p> <p>So when the Form is loaded the site automatically submit (POST) the data (the id of the item and the antiforgerytoken) to mark this item as favorite (again... this happen in background, so the user never see anything).</p> <p>This is the idea over request/response on Firebug:</p> <pre><code>GET http://localhost/User/Favorite/Mark?url=156 Response from GET: &lt;form action="/User/Favorite/Mark?url=156" method="post"&gt; &lt;input name="__RequestVerificationToken" type="hidden" value="WVXhVJJ3VNB8HrZQ6CZBPt35z2zvDjaHmlYWrnCvJoDUgeWMEGUGwm3clCD27vFAsxbs0upiRdVdo9Wsus Z7B6SU NQgV3iSYTUtE/EREWqT1Is/kwNZpdNf/3Pi7fD572pO89lTdYEjL0OlzmPJ5tmRQEUq/oMbuj0MnmPZskykGz6HzRmgC4Ez2bBoCp4" /&gt; &lt;/form&gt; ----------------------------- Then Submit the form with the AntiForgeryToken: POST http://localhost/User/Favorite/Mark?url=156 __RequestVerificationToke... WVXhVJJ3VNB8HrZQ6CZBPt35z2zvDjaHmlYWrnCvJoDUgeWMEGUGwm3clCD27vFAsxbs0upiRdVdo9Wsus Z7B6SU NQgV3iSYTUtE/EREWqT1Is/kwNZpdNf/3Pi7fD572pO89lTdYEjL0OlzmPJ5tmRQEUq/oMbuj0MnmPZskykGz6HzRmgC4Ez2bBoCp4 </code></pre> <p>My question is simple. This is a good practice to get a AntiForgeryToken for an Ajax request? or is a bad idea?</p> <p>I have this question because I don't know if this idea can make a bug hole to exploit on my site in this specific actions.</p> <p>Thanks</p>
    singulars
    1. PO
      singulars
      1. PTAnswer
    1. This table or related slice is empty.
    1. PTQuestion
    1. UStereško
    1. USHolloW
    plurals
    1. PL
      singulars
      1. LTLinked
    2. PL
      singulars
      1. LTLinked
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. PO
      singulars
      1. PTAnswer
    1. VO
      singulars
      1. POIs a good practice to avoid CSRF doing this? (ASP.NET MVC 3)
      1. This table or related slice is empty.
      1. VTUpMod
    1. This table or related slice is empty.
 

Querying!

 
Guidance
A row detail

Detail views are divided into sections. All the information in the data section comes from columns in the selected row. The other sections display data from other, related rows.

Related data can be related in a to-one or a to-many fashion. Captions of data related in a to-many fashion link to a list view showing a filtered view of the table.

Try moving around until you find a non-empty to-many entry and click on the label to get to one. You can move back to the root by clicking on the database name in the header.

SQuiL has stopped working due to an internal error.

If you are curious you may find further information in the browser console, which is accessible through the devtools (F12).

Reload