title: ASP.net MVC AntiForgeryToken over AJAX
body: <p>I am currently developing an MVC application in ASP.net. I am using AJAX.ActionLink to provide a delete link in a list of records, however this is very insecure. I have put this:</p>
  
  <pre><code>&lt;AcceptVerbs(HttpVerbs.Post)&gt;
  </code></pre>
  
  <p>Over the function to do the deleting, which stops the function being called simply by a URL. However, the other security hole that still exists is that if i were to make a basic html page with this content:</p>
  
  <pre><code>&lt;form action="http://foo.com/user/delete/260" method="post"&gt;
  &lt;input type="submit" /&gt;
  &lt;/form&gt;
  </code></pre>
  
  <p>It would still be perfoming a post, but from a different location.</p>
  
  <p>Is it possible to use the AntiForgeryToken with an AJAX ActionLink? If so, is this a secure approach? Are there more security holes i haven't realised?</p>