MVC Set accessibility level on a method called from ajax

Question

I would like to protect my public method from being called by a user.

Because I'm calling the action from an ajax script I can't use any access modifiers, (private, protected etc).

Also, [HttpPost] doesn't stop the user from doing a fake request.

Anyone got a solution?

Thanks

Answer 1

Create an action filter that allows action methods to be called by AJAX only

namespace MyFilters
{
  [AttributeUsage(AttributeTargets.Method)]
  public class AjaxOnlyAttribute : ActionFilterAttribute
  {
    public override void OnActionExecuting(ActionExecutingContext filterContext)
    {
      if (!filterContext.HttpContext.Request.IsAjaxRequest())
      {
        filterContext.HttpContext.Response.StatusCode = 404;
        filterContext.Result = new HttpNotFoundResult();
      }
      else
      {
        base.OnActionExecuting(filterContext);
      }
    }
  }
}

Then apply this to the action method

[AjaxOnly]
public JsonResult DoSomething()
{
  ....