Suppose I have a C# MVC method to send emails using AJAX, like this:
public class EmailController : Controller {
SmtpClient mailserver = new SmtpClient("smtp.foo.com");
public string sendEmail(string from, string to, string subject = "", string body = "", string cc = "", string bcc = "") {
MailMessage message = new MailMessage(from, to, subject, body);
if (cc.Length > 0) {
message.CC.Add(cc);
}
if (bcc.Length > 0) {
message.Bcc.Add(bcc);
}
mailserver.Send(message);
return "EmailSent";
}
}
Are there any security measures that can be implemented to enhance the safety of this method? As it is now, anyone could potentially access it by entering the required information in their address bar, for example:
http://www.foo.com/email/send?from=etc