jQuery Ajax calls and the Html.AntiForgeryToken()

前端 未结 20 2634
鱼传尺愫
鱼传尺愫 2020-11-22 16:34

I have implemented in my app the mitigation to CSRF attacks following the informations that I have read on some blog post around the internet. In particular these post have

20条回答
  •  我在风中等你
    2020-11-22 17:26

    The Solution i found is not for ASPX but for Razor, but quite comperable issue.

    I resolved it by adding the AntiForgery to the request. The HTML Helper does not create a HTML id with the call

    @Html.AntiForgeryToken()
    

    In order to add the token to the postrequest i just added the AntiForgery id to the hidden field with jquery:

    $("input[name*='__RequestVerificationToken']").attr('id', '__AjaxAntiForgeryForm');
    

    This caused the controller to accept the request with the [ValidateAntiForgeryToken] attribute

提交回复
热议问题