title: jQuery Ajax calls and the Html.AntiForgeryToken()
body: <p>I have implemented in my app the mitigation to <a href="https://en.wikipedia.org/wiki/Cross-site_request_forgery" rel="nofollow noreferrer">CSRF attacks</a> following the informations that I have read on some blog post around the internet. In particular these post have been the driver of my implementation</p>
  <ul>
  <li><a href="https://web.archive.org/web/20160301164154/http://blogs.msdn.com:80/b/aspnetue/archive/2010/09/17/second_2d00_post.aspx" rel="nofollow noreferrer">Best Practices for ASP.NET MVC</a> from the ASP.NET and Web Tools Developer Content Team</li>
  <li><a href="https://haacked.com/archive/2009/04/02/anatomy-of-csrf-attack.aspx/" rel="nofollow noreferrer">Anatomy of a Cross-site Request Forgery Attack</a> from Phil Haack blog</li>
  <li><a href="http://davidhayden.com/blog/dave/archive/2009/04/29/AntiForgeryTokenInMVCFramework.aspx" rel="nofollow noreferrer">AntiForgeryToken in the ASP.NET MVC Framework - Html.AntiForgeryToken and ValidateAntiForgeryToken Attribute</a> from David Hayden blog</li>
  </ul>
  <p>Basically those articles and recommendations says that to prevent the CSRF attack anybody should implement the following code:</p>
  <ol>
  <li><p>Add the <code>[ValidateAntiForgeryToken]</code> on every action that accept the POST Http verb</p>
  <p>[HttpPost]
  [ValidateAntiForgeryToken]
  public ActionResult SomeAction( SomeModel model ) {
  }</p>
  </li>
  <li><p>Add the <code>&lt;%= Html.AntiForgeryToken() %&gt;</code> helper inside forms that submits data to the server</p>
   
       
       
   
  </li>
  </ol>
  <p>Anyway in some parts of my app I am doing Ajax POSTs with jQuery to the server without having any form at all. This happens for example where I am letting the user to click on an image to do a specific action.</p>
  <p>Suppose I have a table with a list of activities. I have an image on a column of the table that says &quot;Mark activity as completed&quot; and when the user click on that activity I am doing the Ajax POST as in the following sample:</p>
  <pre><code>$(&quot;a.markAsDone&quot;).click(function (event) {
      event.preventDefault();
      $.ajax({
          type: &quot;post&quot;,
          dataType: &quot;html&quot;,
          url: $(this).attr(&quot;rel&quot;),
          data: {},
          success: function (response) {
              // ....
          }
      });
  });
  </code></pre>
  <p>How can I use the <code>&lt;%= Html.AntiForgeryToken() %&gt;</code> in these cases? Should I include the helper call inside the data parameter of the Ajax call?</p>
  <p>Sorry for the long post and thanks very much for helping out</p>
  <p><strong>EDIT</strong>:</p>
  <p>As per <a href="https://stackoverflow.com/questions/4074199/jquery-ajax-calls-and-the-html-antiforgerytoken/4074289#4074289">jayrdub</a> answer I have used in the following way</p>
  <pre><code>$(&quot;a.markAsDone&quot;).click(function (event) {
      event.preventDefault();
      $.ajax({
          type: &quot;post&quot;,
          dataType: &quot;html&quot;,
          url: $(this).attr(&quot;rel&quot;),
          data: {
              AddAntiForgeryToken({}),
              id: parseInt($(this).attr(&quot;title&quot;))
          },
          success: function (response) {
              // ....
          }
      });
  });
  </code></pre>