Why is JsonRequestBehavior needed?

by

MVC defaults to DenyGet to protect you against a very specific attack involving JSON requests to improve the liklihood that the implications of allowing HTTP GET exposure are considered in advance of allowing them to occur.

This is opposed to afterwards when it might be too late.

Note: If your action method does not return sensitive data, then it should be safe to allow the get.

Further reading from my Wrox ASP.NET MVC3 book

By default, the ASP.NET MVC framework does not allow you to respond to
an HTTP GET request with a JSON payload. If you need to send JSON in
response to a GET, you’ll need to explicitly allow the behavior by
using JsonRequestBehavior.AllowGet as the second parameter to the Json
method. However, there is a chance a malicious user can gain access to
the JSON payload through a process known as JSON Hijacking. You do not
want to return sensitive information using JSON in a GET request. For
more details, see Phil’s post at
http://haacked.com/archive/2009/06/24/json-hijacking.aspx/ or this SO post.

Haack, Phil (2011). Professional ASP.NET MVC 3 (Wrox Programmer to
Programmer) (Kindle Locations 6014-6020). Wrox. Kindle Edition.

Related StackOverflow question

With most recents browsers (starting with Firefox 21, Chrome 27, or IE 10), this is no more a vulnerability.

More Related Contents:

  1. ASP.NET MVC: Custom Validation by DataAnnotation
  2. Prevent Caching in ASP.NET MVC for specific actions using an attribute
  3. Do asynchronous operations in ASP.NET MVC use a thread from ThreadPool on .NET 4
  4. How to elegantly deal with timezones
  5. How to declare a local variable in Razor?
  6. How to edit multiple models in a single Razor View
  7. Uploading image in ASP.NET MVC
  8. How to get the current user in ASP.NET MVC
  9. Disable Required validation attribute under certain circumstances
  10. Injecting dependencies into ASP.NET MVC 3 action filters. What’s wrong with this approach?
  11. How can I test for the presence of an Action Filter with constructor arguments?
  12. Filter/Search using Multiple Fields – ASP.NET MVC
  13. How do I accept an array as an ASP.NET MVC controller action parameter?
  14. Non-static method requires a target
  15. ASP.NET MVC DropDownListFor with model of type List
  16. MD5 hash with salt for keeping password in DB in C#
  17. C# mvc 3 using selectlist with selected value in view
  18. ASP.NET MVC 4 C# HttpPostedFileBase, How do I Store File
  19. Visual Studio – Resx File default ‘internal’ to ‘public’
  20. ASP.NET MVC – How to show unauthorized error on login page?
  21. MVC 4 how pass data correctly from controller to view
  22. How to extend IdentityUser with custom property
  23. Create zip file from byte[]
  24. Possible to access MVC ViewBag object from Javascript file?
  25. Set database timeout in Entity Framework
  26. The model item passed into the dictionary is of type ‘mvc.Models.ModelA’ but this dictionary requires a model item of type ‘mvc.Models.ModelB‘
  27. Model Binding to Enums in ASP.NET MVC 3
  28. Can I use ASP.NET MVC together with regular ASP.NET Web forms
  29. ASP.NET Web API and [Serializable] class
  30. Multiple Models in a Single View (C# MVC3)

Leave a Comment