title: ASP.NET MVC - CSRF on a GET request
body: <p>We have a ASP.NET MVC application. All the POST requests (form submits) have been protected from CSRF  by using <code>@Html.AntiForgeryToken</code> and <code>ValidateAntiForgeryToken</code> attribute.
  One of the action methods on a controller is a GET which returns a report to the user (a pdf file with data from database). The signature is:</p>
  
  <pre><code>[AcceptVerbs(HttpVerbs.Get)]
  public ActionResult GetReport()
  {
      // get data from db
      return GetReport();
  
  }
  </code></pre>
  
  <p>Here are the steps I am following to test the CSRF against this operation:</p>
  
  <ol>
  <li>User logs into the application</li>
  <li>When logged in , user opens the below  HTML file and clicks on the Submit button:</li>
  <li>The report gets downloaded.</li>
  </ol>
  
  <p><strong>Questions:</strong></p>
  
  <p>Can this be considered a CSRF attack?</p>
  
  <p>If yes, how can it be mitigated? Since the action method is a GET request, how can I use MVC's CSRF approach (applying <code>@Html.AntiForgeryToken</code> and <code>ValidateAntiForgeryToken</code> on the action method).</p>
  
  <p><strong>HTML File:</strong></p>
  
  <pre><code>&lt;html&gt;
        &lt;body&gt;
          &lt;form action="https://&lt;baseurl&gt;/Analysis/GetReport"&gt;
                  &lt;input type="submit" value="Submit request" /&gt;
              &lt;/form&gt;
            &lt;/body&gt;
  &lt;/html&gt;
  </code></pre>