title: Why json hijacking can be prevented using POST method?
body: <p>I came across the following ASP.NET MVC error, when returning <code>json</code> in a <code>Get</code> method:</p>
  
  <blockquote>
    <p>This request has been blocked because sensitive information could be
    disclosed to third party web sites when this is used in a GET request.
    To allow GET requests, set JsonRequestBehavior to AllowGet.</p>
  </blockquote>
  
  <p>Apparently this vulnerability is called <strong>json Hijacking</strong>. <a href="https://haacked.com/archive/2009/06/25/json-hijacking.aspx/" rel="noreferrer">This article</a> explains that a website could be exploited when returning <code>json</code> using <code>Get</code>. But returning <code>json</code> in a <code>Post</code> method is safe.</p>
  
  <p>Why changing <code>Get</code> to <code>Post</code> prevents this attack?</p>