c# - 为什么需要 JsonRequestBehavior？

Question

为什么需要 Json 请求行为？

如果我想将 HttpGet 请求限制在我的操作中，我可以使用 [HttpPost] 属性装饰操作

例子:

[HttpPost]
public JsonResult Foo()
{
    return Json("Secrets");
}

// Instead of:
public JsonResult Foo()
{
    return Json("Secrets", JsonRequestBehavior.AllowGet);
}

为什么 [HttpPost] 不够？
为什么框架会为我们拥有的每个 JsonResult 使用 JsonRequestBehavior.AllowGet 来“窃听”我们。如果我想拒绝获取请求，我将添加 HttpPost 属性。

Answer 1

MVC 默认为 DenyGet 以保护您免受涉及 JSON 请求的非常具体的攻击，以提高在允许之前考虑允许 HTTP GET 暴露的影响的可能性他们发生。

这与事后可能为时已晚相反。

注意:如果您的操作方法不返回敏感数据，那么允许获取应该是安全的。

进一步阅读我的 Wrox ASP.NET MVC3 书籍

By default, the ASP.NET MVC framework does not allow you to respond to an HTTP GET request with a JSON payload. If you need to send JSON in response to a GET, you'll need to explicitly allow the behavior by using JsonRequestBehavior.AllowGet as the second parameter to the Json method. However, there is a chance a malicious user can gain access to the JSON payload through a process known as JSON Hijacking. You do not want to return sensitive information using JSON in a GET request. For more details, see Phil's post at http://haacked.com/archive/2009/06/24/json-hijacking.aspx/ or this SO post.

Haack, Phil (2011). Professional ASP.NET MVC 3 (Wrox Programmer to Programmer) (Kindle Locations 6014-6020). Wrox. Kindle Edition.

相关 StackOverflow 问题

With most recents browsers (starting with Firefox 21, Chrome 27, or IE 10), this is no more a vulnerability.