gistfile1.cs

[TestFixture]
public class AntiForgeryTests
{
    [Test]
    [TestCaseSource(typeof(AllMvcActions), "GetActions")]
    public void AllPostActionsShouldHaveAntiForgeryValidation(MethodInfo action)
    {
        if (!action.GetCustomAttributes(typeof (HttpPostAttribute), false).Any())
            return;

        if (action.GetCustomAttributes(typeof (ValidateAntiForgeryTokenAttribute), false).Any())
            return;

        if (action.DeclaringType == null)
            throw new InvalidOperationException("An assumption about reflection was just proven wrong: action.DeclaringType was null. Test failed (method may or may not actually be correct).");

        Assert.Fail("{0}.{1} is marked with [HttpPost] but missing [ValidateAntiForgeryToken]", action.DeclaringType.Name, action.Name);
    }

    public class AllMvcActions
    {
        public IEnumerable<MethodInfo> GetActions()
        {
            var controllers = typeof(MvcApplication)
                .Assembly
                .GetTypes()
                .Where(t => typeof(Controller).IsAssignableFrom(t));

            var actions = controllers
                .SelectMany(c => c.GetMethods(BindingFlags.Instance | BindingFlags.Public | BindingFlags.DeclaredOnly))
                .Where(m => !m.IsSpecialName);

            return actions;
        }
    }
}