开发者

What triggers MVC JSON Get blocking - intermittently working

I have a JSON method that accepts a GET request and returns a JSON object (not array). I'm aware of JSON Hijacking and the implications. I've开发者_高级运维 read the Phil Haack post. The problem is that the method works 98% of the time for GET and POST. The other times I'm recording this error:

This request has been blocked because sensitive information could be disclosed to 
third party web sites when this is used in a GET request. To allow GET requests, set
JsonRequestBehavior to AllowGet.

My method is simple and takes a single integer parameter...

[Authorize]
public ActionResult MyMediaJSON(int? id) {
    <get data & return result>
}

What conditions trigger the message? What should look for as I debug this?


I've just looked at the MVC source code and it do not add up with what you are saying in your question.

To me it looks like JsonRequestBehavior.DenyGet is used for all JSON results per default. Hence you should get the error message each time you try to return JSON from a controller using a GET request (without specifying JsonRequestBehavior.AllowGet).

The actual control is done in JsonResult.ExecuteResult and looks like:

if (JsonRequestBehavior == JsonRequestBehavior.DenyGet &&
    String.Equals(context.HttpContext.Request.HttpMethod, "GET", StringComparison.OrdinalIgnoreCase)) {
    throw new InvalidOperationException(MvcResources.JsonRequest_GetNotAllowed);
}

What conditions trigger the message? What should look for as I debug this?

Any actions that are getting invoked through GET that returns JsonResult without specifying JsonRequestBehavior.AllowGet. (the Json method in the controller uses JsonResult)

0

上一篇:

下一篇:

精彩评论

暂无评论...
验证码 换一张
取 消

最新问答

问答排行榜