ASP .NET MVC How to make Url that look like POST not GET

Question

So normally I have links like:

http://domain.com/action?some=1&foo=2

and so on. It's make me really upset, as some clever users might just reinvent link on their own and get access to some data, which is not desirable. I know i can setup security On server side, but i'd like to make links look like:

http://domain.com/action

And 'some' and 'foo' send like POST request

Filip Ekberg · Accepted Answer · 2011-07-03 18:04:50Z

1

Actions in ASP.NET MVC don't distinguish betweed Post and Get as far as the parameters to the actions are concerned. However, you can start by marking your actions with the attribute [HttpPost]. This will limit the request options to post only.

Now to the second "issue", you need to change all your links so that you use post instead of get, you can do this by using ajax, check out $.post in jQuery for that.

This doesn't solve any security issues with your parameters though, it generally doesn't matter if you show it in the querystring or of it is sent by a post. If someone wants to inject something into your post-data, it's not rocket science.

answered Jul 3, 2011 at 18:04

Filip Ekberg

36.3k20 gold badges129 silver badges184 bronze badges

Sign up to request clarification or add additional context in comments.

4 Comments

Łukasz Baran Over a year ago

True. But at least links looks nicer. I've been curious because I've seen similiar solution on diffrent sites where there is no query string, but data must be somehow passed to server

Filip Ekberg Over a year ago

Yup, but the downside is that you can't share the link with your friends.

Łukasz Baran Over a year ago

That's not the problem, because I doubt anyone would share a link to things like post edit.

Filip Ekberg Over a year ago

It's all about the reason. If it is a "edit"-page, sure use POST instead of GET, makes more sense. But if it is a search that you want to be able to share using GET would make more sense.

tvanfosson · Accepted Answer · 2011-07-03 18:04:52Z

1

You have to wrap it in a form for it to work; with the inputs being hidden. On the server side you have to restrict the action to only responding to a POST request. However, this doesn't really solve your problem as a sufficiently interested and knowledgeable user can just as easily craft a POST as a GET.

answered Jul 3, 2011 at 18:04

tvanfosson

534k102 gold badges703 silver badges801 bronze badges

Comments

Aleksei Pugachev · Accepted Answer · 2011-07-05 08:59:27Z

You can add form to the view and apply [HttpPost] attribute for the action which will take the model after the post.

Adding form to the razor view (also you will need a button or a link to sumbit):

@using (Html.BeginForm("SomeAction", "SomeController", FormMethod.Post, new { @id = "someFormId" }))
{
    @Html.HiddenFor(model => model.some)
    @Html.HiddenFor(model => model.foo)
}

And here is a Controller with action to proccess your post:

public class SomeController : Controller
{
    [HttpPost]
    public ActionResult SomeAction(SomeModel model)
    {
        //process 'some' and 'foo' here
        return View(model);
    }
}

To enhance security you can easily encrypt/decrypt "some" and "foo" values.

Collectives™ on Stack Overflow

ASP .NET MVC How to make Url that look like POST not GET

3 Answers 3

4 Comments

Comments

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

3 Answers 3

4 Comments

Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Related