title: Secure way to Delete a record in ASP.Net MVC
body: <p>I want to delete a product from my ASP.Net MVC 5 website. I want to know if adding <code>[AntiForgeryToken]</code> and <code>[Authorize]</code> is enough to secure the Delete operation?</p>
  
  <p><strong>View</strong></p>
  
  <pre><code> &lt;p&gt;Delete: @Model.Name&lt;/p&gt;
   @using (Html.BeginForm("Delete", "ProductController", FormMethod.Post, new { ProductId = Model.ProductId }))
   {
      @Html.AntiForgeryToken()
      &lt;button type="submit"&gt;Delete&lt;/button&gt;
   }
  </code></pre>
  
  <p><strong>Controller</strong></p>
  
  <pre><code>[HttpPost]
  [Authorize]
  [ValidateAntiForgeryToken]
  public ActionResult Delete(long ProductId)
  {
      /* Do I need to check if the logged in User has permission to delete the product?
      var product = ProductRepository.Get(Id);
      if (product.Creator == User.Identity.GetUserId&lt;long&gt;())
      {
          ProductRepository.Delete(ProductId);
      }
      */
  
      // or, can I avoid the trip to DB and just delete the record?        
      ProductRepository.Delete(ProductId); 
  }
  </code></pre>
  
  <p><strong>Scenario:</strong> A hacker registers on my website and create a valid account. Now the hacker views his own product and obviously he has an AntiForgeryToken. Can he now just change the ProductId in the browser and Post a request to delete someone else's Product? </p>