antiforgerytoken | 易学教程

How to include the @Html.AntiForgeryToken() when deleting an object using a Delete link

阅读更多关于 How to include the @Html.AntiForgeryToken() when deleting an object using a Delete link

问题 i have the following ajax.actionlink which calls a Delete action method for deleting an object:- @if (!item.IsAlreadyAssigned(item.LabTestID)) { string i = "Are You sure You want to delete (" + @item.Description.ToString() + ") ?"; @Ajax.ActionLink("Delete", "Delete", "LabTest", new { id = item.LabTestID }, new AjaxOptions { Confirm = i, HttpMethod = "Post", OnSuccess = "deletionconfirmation", OnFailure = "deletionerror" }) } but is there a way to include @Html.AntiForgeryToken() with the

Why does @Html.AntiForgeryToken() generate different tokens in same response?

阅读更多关于 Why does @Html.AntiForgeryToken() generate different tokens in same response?

A single Razor view contains several forms, each with its own call to @Html.AntiForgeryToken() <form id="f1"> @Html.AntiForgeryToken() </form> <form id="f2"> @Html.AntiForgeryToken() </form> As I understand it, both of these anti forgery tokens should be the same. <form id="f1"> <input name="__RequestVerificationToken" type="hidden" value="duVT4VtiYybun-61lnSY1ol__qBwawnELooyqT5OSrCJrvcHvDs_Nr9GLxNxwvBaI4hUcKZVkm6mDEmH2UqNorHD1FnJbKJQLWe8Su_dhy_nnGGl5GhqqC3yRGzcxbBM0" /> </form> <form id="f2"> <input name="__RequestVerificationToken" type="hidden" value="ZMISz3IWHU

Is it possible/right to use multiple @Html.AntiForgeryToken() in 2 different forms in one page?

阅读更多关于 Is it possible/right to use multiple @Html.AntiForgeryToken() in 2 different forms in one page?

问题 I have been facing serious problem with @Html.AntiForgeryToken() . I have a register controller which had a create view to create/register new members. For that reason I used a @Html.AntiForgeryToken() without using any SALT in my main submit form. Now I would like to validate user name if it is already exist on the database on the blur event of my user name textbox. For this validation I wrote a new controller named 'Validation' and wrote a method with a constant validation SALT: [HttpPost]

Any reason not to trust ASP.NET AntiForgeryToken?

阅读更多关于 Any reason not to trust ASP.NET AntiForgeryToken?

I know that Stack Exchange sites do not use the ASP.NET MVC built-in @Html.AntiForgeryToken() for the prevention of XSRF/CSRF attacks. Instead of creating a hidden input named __RequestVerificationToken with a really long value based on the machineKey section of the web.config, the Stack Exchange method creates an input named fkey with a MUCH more succinct value. This is apparently a Guid, and based on evidence from the Stack Exchange Data Explorer project on Google Code , this value is tied to each individual user, remaining fairly constant until you log in or out. Also, the Stack Exchange

Anti forgery token on login page

阅读更多关于 Anti forgery token on login page

I have implemented antiforgery token on my login page. Now I had one user pressing back key on the keyboard, and when they click on login button again after filling their credentials, they get error page. Is there some better way of handeling this case like redirect them to fresh login page? Page that is login page is : /account/logon If login details are sucessfull the user is redirected to :Home/Index page on which the user pressed button back. Adam Tuliper - MSFT Don't implement the ASP.NET AntiForgeryToken on your login page. The token is based on a username among other criteria and a

When the use of a AntiForgeryToken is not required /needed?

阅读更多关于 When the use of a AntiForgeryToken is not required /needed?

UPD: Same question asked on security.stackexchange.com and the answer I got is different. Please follow there, to get the correct answer! I'm running a rather large site with thousands of visits every day, and a rather large userbase. Since I started migrating to MVC 3, I've been putting the AntiForgeryToken in a number of forms, that modify protected data etc. Some other forms, like the login / registration also use the AntiForgeryToken now, but I'm becoming dubious about their need there in the first place, for a couple reasons... The login form requires the poster to know the correct

MVC 4 provided anti-forgery token was meant for user “” but the current user is “user”

阅读更多关于 MVC 4 provided anti-forgery token was meant for user “” but the current user is “user”

问题 I've recently put Live a web application which was built using MVC 4 and Entity Framework 5 . The MVC application uses Razor Views . I noticed using Elmah that when users are logging into the application, sometimes they are getting the following error The provided anti-forgery token was meant for user "" but the current user is "user" I've done a bit of research already on how to fix this issue, but nothing seems to work for me. Please see my Login View and corresponding Controller Actions

RequestVerificationToken does not match

阅读更多关于 RequestVerificationToken does not match

I have a problem with the anti CRSF MVC mechanism. The cookie and the form input returned does not match. I'm getting an error every single time, only in one specific page. In the rest of the application it works well. The server is returning HTTP 500 Internal Server Error and I can see on the log this exception: [System.Web.Mvc.HttpAntiForgeryException]: {"A required anti-forgery token was not supplied or was invalid."} This is the hidden input that the server is generating is: <input name="__RequestVerificationToken" type="hidden" value=

Html.AntiForgeryToken() still required?

阅读更多关于 Html.AntiForgeryToken() still required?

问题 Is @Html.AntiForgeryToken() still required in ASP.NET .NET4.6 vNext? The form decorations have changed to <form asp-controller="Account" asp-action="Login" asp-route-returnurl="@ViewBag.ReturnUrl" method="post" class="form-horizontal" role="form"> From this @using (Html.BeginForm("Login", "Account", new { ReturnUrl = ViewBag.ReturnUrl }, FormMethod.Post, new { @class = "", role = "form" })) And no longer include this @Html.AntiForgeryToken() The Controller Actions are still marked with the

If I add multiple forms in a single page, do I need to add separate Anti-Forgery Tokens in each form?

阅读更多关于 If I add multiple forms in a single page, do I need to add separate Anti-Forgery Tokens in each form?

问题 If the answer is yes then how would ASP.NET MVC find out that which token was linked to which form and how to validate it? I've seen it is creating two separate tokens for each form. 回答1: There is nothing specific that you need to do in this case. ASP.NET MVC will simply reuse the same value for all forms so it doesn't need to know which form sent the request in order to validate it. Simply put an Html.AntiForgeryToken() in each form and decorate each controller action you are posting to with