security - Prevent CSRF Attack for PUT and Delete request ASP.NET Web API -

does validateantiforgerytoken work put , delete requests or post request in asp.net web api? if not, best way make secure?

anti csrf done matching tokens both cookie , body validate request in non-ajax call browser form post.

in ajax call, it's recommended put token in custom header. if installed latest asp.net 2012.2 update. has spa template in mvc project dialog, demonstrates how prevent csrf in spa app. here code copied template validate header token server side.

public class validatehttpantiforgerytokenattribute : authorizationfilterattribute {     public override void onauthorization(httpactioncontext actioncontext)     {         httprequestmessage request = actioncontext.controllercontext.request;          try         {             if (isajaxrequest(request))             {                 validaterequestheader(request);             }             else             {                 antiforgery.validate();             }         }         catch (httpantiforgeryexception e)         {             actioncontext.response = request.createerrorresponse(httpstatuscode.forbidden, e);         }     }      private bool isajaxrequest(httprequestmessage request)     {         ienumerable<string> xrequestedwithheaders;         if (request.headers.trygetvalues("x-requested-with", out xrequestedwithheaders))         {             string headervalue = xrequestedwithheaders.firstordefault();             if (!string.isnullorempty(headervalue))             {                 return string.equals(headervalue, "xmlhttprequest", stringcomparison.ordinalignorecase);             }         }          return false;     }      private void validaterequestheader(httprequestmessage request)     {         string cookietoken = string.empty;         string formtoken = string.empty;          ienumerable<string> tokenheaders;         if (request.headers.trygetvalues("requestverificationtoken", out tokenheaders))         {             string tokenvalue = tokenheaders.firstordefault();             if (!string.isnullorempty(tokenvalue))             {                 string[] tokens = tokenvalue.split(':');                 if (tokens.length == 2)                 {                     cookietoken = tokens[0].trim();                     formtoken = tokens[1].trim();                 }             }         }          antiforgery.validate(cookietoken, formtoken);     } } 

from client side, need set header in ajax call. code todo.datacontext.js:

function ajaxrequest(type, url, data, datatype) { // ajax helper     var options = {         datatype: datatype || "json",         contenttype: "application/json",         cache: false,         type: type,         data: data ? data.tojson() : null     };     var antiforgerytoken = $("#antiforgerytoken").val();     if (antiforgerytoken) {         options.headers = {             'requestverificationtoken': antiforgerytoken         }     }     return $.ajax(url, options); }