ASP.NET

i was reading article on web security from this url http://haacked.com/archive/2009/06/25/json-hijacking.aspx/

the person so if any action method return data in json format for get request then malicious user can do CSRF. he suggested if stop delivering json data for get request then bad people can not hijack our json.

my question is if hacker drop a jquery script which make a ajax post request then also json will be delivered to client. so please tell me after reading that article that what the person is trying to say like deliver json for post request that will be invulnerable. because auth cookie goes at the time of get & post method too. help me to understand how to stop JSON Hijacking and also why author is saying post is secure than get?

Attachments:<asp:FileUpload ID="fileUpload1" runat="server" /><br />
<asp:Button ID="btnUpload" runat="server" Text="Upload" onclick="btnUpload_Click" usesubmitbehavior="false"/>

<asp:GridView ID="gvDetails" CssClass="Gridview" runat="server"
        AutoGenerateColumns="False"
        DataSourceID="SqlDataSource2">
<HeaderStyle BackColor="#df5015" />
<Columns>
<asp:BoundField DataField="Id" HeaderText="Id" Visible="False" />
    <asp:BoundField DataField="filepath" HeaderText="filepath" Visible="False" />
<asp:BoundField DataField="FileName" HeaderText="File Name" />
<asp:TemplateField>
<ItemTemplate>
<asp:LinkButton ID="lnkDownload" runat="server" Text="Download" OnClick="lnkDownload_Click"></asp:LinkButton>
</ItemTemplate>
</asp:TemplateField>
    <asp:BoundField DataField="CVSNumber" HeaderText="Company Auto" Visible="False" />

</Columns>
</asp:GridView>

' Save files to Folder and files path in database
Protected Sub btnUpload_Click(ByVal sender As Object, ByVal e As EventArgs) 'Handles btnUpload.Click
    Dim cvsfilename As String = Path.GetFileName(fileUpload1.PostedFile.FileName)

    Dim firmcvs As String = CompanyAuto_TB.Text

    fileUpload1.SaveAs(Server.MapPath("files/" & cvsfilename))

    sql = "Insert INTO tblFiles(Filename, Filepath,CVSNumber) "
    sql += "values(@Name,@PAth,@CompanyAuto_tb) "

    Dim cmd As SqlCommand = New SqlCommand(sql, New SqlConnection(conString))
    cmd.Parameters.AddWithValue("@Name", cvsfilename)
    cmd.Parameters.AddWithValue("@Path", "files/" & cvsfilename)
    cmd.Parameters.AddWithValue("@CompanyAuto_tb", firmcvs)

    Try
        cmd.Connection.Open()
        cmd.ExecuteNonQuery()
    Catch ex As Exception
        Response.Write(ex.ToString())
    Finally
        If cmd IsNot Nothing Then
            If cmd.Connection.State <> ConnectionState.Closed Then
                cmd.Connection.Close()
            End If
            cmd.Dispose()
        End If

    End Try





' This button click event is used to download files from gridview
Protected Sub lnkDownload_Click(ByVal sender As Object, ByVal e As EventArgs)
    Dim lnkbtn As LinkButton = TryCast(sender, LinkButton)
    Dim gvrow As GridViewRow = TryCast(lnkbtn.NamingContainer, GridViewRow)
    Dim filePath As String = gvDetails.DataKeys(gvrow.RowIndex).Value.ToString()
    Response.ContentType = "image/jpg"
    Response.AddHeader("Content-Disposition", "attachment;filename=""" & filePath & """")
    Response.TransmitFile(Server.MapPath(filePath))
    Response.[End]()
End Sub