//在View中

<script type="text/javascript">

  @functions{

    public string ToKenHeaderValue()

   {

        string cookieToken,fromToken;

        AntiForgery.GetTokens(null,out cookieToken,out fromToken);

        return  cookieToken+":"+fromToken;

   }

}

$function({

  。。。。。

  $.ajax("api/Value",{

   data:{...},

    type:'post',

   dataType:'json',

   headers:{'RequestVerificationToKen':'@ToKenHeaderValue()'},

  success:fucntion(data){....}

   })

})

</script>

//自己写的过滤器

 1 public class MyValidateAntiForgeryToKenAttribute:FileterAttribute,IAuthorizationFilter

 {

     private void ValidateRequestHeader(HttpRequestBase request)

   {

        string cookieToKen="";

        string fromToKen="";

        string tokenValue=request.Header["RequestVerificationToKen"];

        if(!string.IsNullOrEmpty(tokenValue))

         {

              string[] tokens=tokenValue.Split(':');

              if(tokens.Length=)

               {

                     cookieToken=tokens[].Trim();

                     fromToKen=tokens[].Trim();

                }

         }

     AntiForGery.Validate(cookieToken,fromToken);

   }

 }
20 public void OnAuthiorization(AuthorizationContexte context)
21 {
22    try
23    {
24       if(context.HttpContext.Request.IsAjaxRequest())//判断是否ajax提交
25        {
26           ValidateRequetHeader(context.HttpContext.Request);
27        }
28        else
29          AntiForgery.Validate();
30  }
31  catch
32  {
33       throw new HttpAntiForgeryException("...");
34  }

 [HttpPost]//指示POST提交
 [MyValidateAntiForgeryToKen]//这儿调用自己写的过滤器，实现防止CSRF攻击
 public ActionResult Value()

 {

 .......

 }