Hi,
I'm converting a web application over from using razor view server-side rendering to one that builds the UI in the browser via JavaScript. This got me thinking about CSRF. In a vanilla ASP .NET MVC application that uses cshtml for rendering, I would decorate
my controller actions with the MVC antiforgery token attribute and make a form with the HtmlHelper AntiforgeryToken to create a hidden field and fill it with the token.
Now, in my revised web application, I'm not building a form at all. If I were submitting a form (i.e. using x-www-form-urlencoded content type) then I would definitely need to put CSRF protection in place. But instead of submitting a form via a http post,
I'm now sending my data down in a post in JSON format. As far as I know, and according to the W3C spec, there's no way for a simple HTML form to submit data to a server as application/json. This need to be done in code. And if it's done in co ...
Go to the complete details ...