Programming Microsoft ASP.NET 4 - Dino Esposito [462]
methods of the Web service class decorated with the WebMethod attribute can be invoked from the AJAX page. Any method is invoked using the HTTP POST verb and returns any value as a JSON object. You can change these default settings on a per-method basis by using an optional attribute—ScriptMethod. In particular, through the ScriptMethod attribute you can enable HTTP GET calls and use XML instead of JSON as the serialization format.
Enabling the use of the HTTP GET verb opens security holes: the service method can be invoked through a cross-site scripting attack that attaches an external script to the