Hello,

I have a module, where I am building a WebAPI service to retrieve data through jQuery AJAX. The main purpose of this is to improve performance. Some of this data is sensitive and I would like to make the service secure.

I looked into implementing ValidateAntiForgeryToken, but it appears to be for HttpPost methods only, the ones that modify data. http://www.dnnsoftware.com/answers/va...

So how do I make a Get method secure? It does not modify any data on invocation, only retrieves some secure data for the calling page. I already have the "DnnAuthorize" attribute on the method.

Thanks.

Thank you Clinton, for the reply and for the great article. I followed that article when working with DNN Web APIs for the first time.

Unfortunately, I am not able to use DNNModuleAuthorize as my module has its own permission settings, where admins can assign actions to roles. I just want to make sure that a registered user is accessing the service, and the rest can be handled by the module. I am wondering if just the DNNAuthorize attribute on the method is secure enough - for example, against CSRF attack.

Appreciate your input.