This request has been blocked because sensitive information could be disclosed...ASP.NET JSON Return error?

Your question has its own answer, take a look at the line "To allow GET requests, set JsonRequestBehavior to AllowGet."

So you need to have code, which allows Get Request

public JsonResult ShowCompaniesDataTable()
        {
            using (var context = new ModelEntities())
            {

           //some code here
                    return Json(new { sEcho = sEcho, iTotalRecords = list.Count, iTotalDisplayRecords = list.Count, aaData = list2 },JsonRequestBehavior.AllowGet);
                
            }
        }

Now why ASP.NET shows this error as your above method must be POST, by default, the ASP.NET MVC framework does not allow you to respond to an HTTP GET request with a JSON payload. If you need to send JSON in response to a GET, you'll need to explicitly allow the behavior by

If you need to send JSON in response to a GET, you'll need to explicitly allow the behavior by using JsonRequestBehavior.AllowGet as the second parameter to the JSON method. However, there is a chance a malicious user can gain access to the JSON payload through a process known as JSON Hijacking. You do not want to return sensitive information using JSON in a GET request.

You can read about JSON hijacking here

In MVC they block Json for GET requests (as you can tell from the error) for security reasons. If you want to override that behavior, check out the overload for Json that accepts a JsonRequestBehavior parameter.

public JsonResult ShowCompaniesDataTable()
        {
            using (var context = new ModelEntities())
            {

           //some code here
                    return Json(new { sEcho = sEcho, iTotalRecords = list.Count, iTotalDisplayRecords = list.Count, aaData = list2 },JsonRequestBehavior.AllowGet);
                
            }
        }

Long story short, if your JSON payload:

• Contains sensitive non-public data
• Returns an Array
• Responds to a GET request

Then the data is vulnerable to a JSON hijacking. Typically, it's not *your* data but the data of the users of your website.