Oh you only want section action to be possible after they've executed first action? You'll have to figure out a way to ensure one of called form a page that was issued by the other. Something like an anti forgery token plus a counter or a token of some sort.
Anything you send back to the client should be
protected.
skneife
0 Points
9 Posts
How to make an Action only callable from another Action and not from a url ?
Aug 18, 2012 07:46 PM|LINK
How to make an Action only callable from another Action and not from a url ?
Sam
BrockAllen
All-Star
27574 Points
4912 Posts
MVP
Re: How to make an Action only callable from another Action and not from a url ?
Aug 18, 2012 09:35 PM|LINK
Apply the [ChildActionOnly] attribute on the nested child action.
DevelopMentor | http://www.develop.com
thinktecture | http://www.thinktecture.com/
DhavalShah89
Member
112 Points
79 Posts
Re: How to make an Action only callable from another Action and not from a url ?
Aug 19, 2012 02:07 AM|LINK
http://msdn.microsoft.com/en-us/library/system.web.mvc.childactiononlyattribute(v=vs.98).aspx
skneife
0 Points
9 Posts
Re: How to make an Action only callable from another Action and not from a url ?
Aug 25, 2012 04:21 PM|LINK
[ChildActionOnly] is not suitable for this issue.
Look at this code :
[AcceptVerbs(HttpVerbs.Post)] public ActionResult FisrtAction(){ ... return RedirectToAction("SecondAction"); } public ActionResult SecondAction(){ ... return View("MyView"); }The action named SecondAction must be used only by the FirstAction.
So how avoid a direct web access via an url to the second action ?
Thanks for help.
Sam
BrockAllen
All-Star
27574 Points
4912 Posts
MVP
Re: How to make an Action only callable from another Action and not from a url ?
Aug 25, 2012 04:35 PM|LINK
Oh you only want section action to be possible after they've executed first action? You'll have to figure out a way to ensure one of called form a page that was issued by the other. Something like an anti forgery token plus a counter or a token of some sort. Anything you send back to the client should be protected.
DevelopMentor | http://www.develop.com
thinktecture | http://www.thinktecture.com/