csrf - How to use AntiForgeryToken on a MVC action method which accepts both HttpGet and HttpPost

Question

We have an asp.net MVC5 web application that contains an action method which accepts both httpget and httppost verbs.

Below is the action method behavior on the application for user operations.

1. User clicks on an anchor on a web page to initiate update or delete operation.
2. Application sends a request for the mvc action method with HttpGet
3. Action method shows a confirmation dialog to perform that specific operation.
4. User confirms the operation
5. Application sends a request for the same action method with HttpPost
6. Action method either updates or deletes rows in the database

This action method is being used to show a confirmation dialog before performing an operation when called using GET and update database after taking a confirmation upon called using POST.

Articles on the web related to preventing cross site request forgery suggest using the action method only with httppost in order to use antiforgerytoken.

Is it possible to use antiforgerytoken on this method?

If it is possible to use, how to validate antiforgerytoken in the action method?

Are there other ways to prevent cross site request forgery on this action method except using antiforgerytoken?

Thank you.

question from:https://stackoverflow.com/questions/65849967/how-to-use-antiforgerytoken-on-a-mvc-action-method-which-accepts-both-httpget-an

Answer 1

Waitting for answers