Using $.getJSON in .NET MVC 3.0

Question

I want to use jQuery.getJSON function in ASP.NET MVC 3.0, so I wrote the code below for test:

    <input id="btn" type="button" />

<script>
        $("#btn").click(function () {
            $.getJSON("/Location/GetData", null, function (data) {
                alert(data);
            });
        });


</script>

and I have a LocationController with below method:

public JsonResult GetData()
        {
            List<int> result = new List<int>(){1, 4, 5};
            return Json(result);
        }

But it doesn't work! The GetData method calls, but 'alert' is not shown!

you should use firebug and turn on the net tab and check the xhr. it should tell u what the post and response of your ajax calls are. — melaos
– melaos, Commented Jun 1, 2011 at 6:34

Alconja · Accepted Answer · 2011-06-01 06:05:41Z

8

You need to tell MVC to allow your JSON action to be called via GETs by changing your return to:

return Json(result, JsonRequestBehavior.AllowGet);

By default (for security reasons) they only allow Json to be requested via POSTs.

answered Jun 1, 2011 at 6:05

Alconja

14.9k3 gold badges62 silver badges61 bronze badges

Sign up to request clarification or add additional context in comments.

3 Comments

mezoid Over a year ago

While that does allow a person to get passed the issue, it isn't a good solution due to the security issue you mentioned. The better answer is stackoverflow.com/a/6196969/39532

Alconja Over a year ago

@mezoid - There's nothing inherently wrong with using JSON in conjunction with GETs so long as you're not using to pass sensitive information (or to perform actions). Lots of libraries allow/support it (jQuery has getJSON, google maps API support JSON GETs, etc, etc). As with many things in development, it basically boils down to being aware of the security issues (as linked to in my answer) and using the right tools for the job.

mezoid Over a year ago

I agree with what you're saying. however, it is not clear whether the op has sensitive data in his real-world usecase. I can imagine that the op and anyone else who benefits from your reply may take the answer for granted and not dig to fully understand the security concern. I would think that your answer would be better if you broke it into two sections. 1 If you have sensitive data do this... 2 If you know your data is not sensitive you can do this...

Alastair Pitts · Accepted Answer · 2011-06-01 06:08:48Z

To protect against cross-side-scripting attacks & JSON Hijacking, MVC 2+ (I think it was 2), requires that you access actions with JSON responses using POST, rather than GET.

You can override this behaviour by using the overload of Json(), where you set the JsonRequestBehavior.AllowGet flag, but as described in the blog post, this is not a good/safe idea.

The way I do all of my JSON requests, whether they be jsut loading data, or posting back, is to use the $.post jQuery method, and limit the controller action to only accept HttpPost.

so your code would become:

$("#btn").click(function () {
    $.post("/Location/GetData", null, function (data) {
        alert(data);
    });
});

and

[HttpPost]
public JsonResult GetData()
{
    List<int> result = new List<int>(){1, 4, 5};
    return Json(result);
}

Mikael Eliasson · Accepted Answer · 2011-06-01 06:06:18Z

2

First of all. Install Firebug for Firefox so you can inspect the response the server sends, Chrome and IE has built in tools you can use too.

Without knowing the response I will assume the problem is that ASP.NET MVC protects you against JSON hijacking byt not allowing to return JSON for a GET request by default.

Try changing to:

return Json(result, JsonRequestBehavior.AllowGet);

answered Jun 1, 2011 at 6:06

Mikael Eliasson

5,29727 silver badges29 bronze badges

Collectives™ on Stack Overflow

Using $.getJSON in .NET MVC 3.0

3 Answers 3

3 Comments

Comments

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

3 Answers 3

3 Comments

Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Related