jQuery Ajax calls and the Html.AntiForgeryToken()

前端 未结 20 2613
鱼传尺愫
鱼传尺愫 2020-11-22 16:34

I have implemented in my app the mitigation to CSRF attacks following the informations that I have read on some blog post around the internet. In particular these post have

20条回答
  •  傲寒
    傲寒 (楼主)
    2020-11-22 17:27

    1.Define Function to get Token from server

    @function
    {
    
            public string TokenHeaderValue()
            {
                string cookieToken, formToken;
                AntiForgery.GetTokens(null, out cookieToken, out formToken);
                return cookieToken + ":" + formToken;                
            }
    }
    

    2.Get token and set header before send to server

    var token = '@TokenHeaderValue()';    
    
           $http({
               method: "POST",
               url: './MainBackend/MessageDelete',
               data: dataSend,
               headers: {
                   'RequestVerificationToken': token
               }
           }).success(function (data) {
               alert(data)
           });
    

    3. Onserver Validation on HttpRequestBase on method you handle Post/get

            string cookieToken = "";
            string formToken = "";
            string[] tokens = Request.Headers["RequestVerificationToken"].Split(':');
                if (tokens.Length == 2)
                {
                    cookieToken = tokens[0].Trim();
                    formToken = tokens[1].Trim();
                }
            AntiForgery.Validate(cookieToken, formToken);
    

提交回复
热议问题