Security and Cross Domain with ASP.NET MVC JsonResult and jQuery

Question

I am using asp.net MVC to develop an application that will have ajax interactions. I have JsonResult methods in the controller returning my json serialized data. So for example when a request is made to http://somesite.com/findwidgets/ mvc serializes the data as json and sends it back.

I am using jQuery on the client side to handle the ajax requests and to then manipulate the results. I am not having any trouble getting the data but i have found that i can make requests to http://somesite.com/findwidgets/ from the address bar of the browser and it will return the json data as a download.

Also, how do i ensure that others cannot simply make requests and grab data using http://somesite.com/findwidgets/ ?

Is cross domain the right topic here or is that speaking to other security problems?

Thanks

Chris · Accepted Answer · 2009-01-22 17:19:30Z

2

Also, how do i ensure that others cannot simply make requests and grab data using http://somesite.com/findwidgets/ ?

The issue you describe is the same one people refer to when asking how they can prevent people from posting to their form from another site. The only reasonable answer I have seen is to use some type of session key system wherein a key is generated for each request and each subsequent request must pass the previously generated key for validation. A request that arrives with no key or an invalid key is denied access.

i have found that i can make requests to http://somesite.com/findwidgets/ from the address bar of the browser and it will return the json data as a download.

This is because JSON is not recognized as a text mime type, and browsers will only display text mime types directly in the browser. Anything else will be offered as a download rather than displayed inline.

answered Jan 22, 2009 at 17:19

Chris

28.1k26 gold badges132 silver badges227 bronze badges

Sign up to request clarification or add additional context in comments.

2 Comments

Jeremy Over a year ago

Thanks for your post... Do you know in the MVC framework for .net if there is a way to keep the JsonResult method from responding to requests made via the address bar?

Dale Ragan Over a year ago

You will want to use the AcceptVerbsAttribute on your action. Basically you do not want to allow Get requests to the Action. Example, on your action add the following: [AcceptVerbs(HttpVerbs.Post)] This will ensure that only POST requests will be able to call the action.

IEnumerator · Accepted Answer · 2009-02-03 02:21:18Z

0

consider checking for request host also, and limit it to the current domain.

answered Feb 3, 2009 at 2:21

IEnumerator

2,9725 gold badges31 silver badges34 bronze badges

Comments

zihotki · Accepted Answer · 2009-02-16 23:58:48Z

0

Also you can use IsAjaxRequest() property of the controller (if it false - return null result for example). In order to prevent posting/getting the data from other sites you can check Request.UrlReferrer property (but the browser can lie about it).

answered Feb 16, 2009 at 23:58

zihotki

5,19124 silver badges26 bronze badges

Collectives™ on Stack Overflow

Security and Cross Domain with ASP.NET MVC JsonResult and jQuery

3 Answers 3

2 Comments

Comments

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

3 Answers 3

2 Comments

Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Related