0

I noticed that when there are many anti forgery tokens on one page, the IE will fail (while Firefox etc. work good).

So I am trying to see how can I reduce the number of such tokens in my case.

The case is like: It is a product listing page. On one page, it will list 200 products per page (hard requirement, must be 200 OR MORE products per page). For each product, it will have 4 links/actions, such as edit it, delete it, move it up in the order, move it down in the order. (hard requirement, must show the links for these 4 actions)

Currently, for each of the link/action, it is a form, and it has the token from @Html.AntiForgeryToken(). So the page will have 800 forms and 800 anti forgery tokens, causing IE to fail.

Any idea how it can be improved? I may try to put the 4 actions into 1 form, and using another parameter to distinguish the actions and handle them differently on the backend. In this way, each page will have 200 forms/tokens (but the requirement is it will have 200 or more, so potentially it will have more).

Just wonder whether there is other comments. For example, can I use the same anti forgery token for all the places in one page? (but the customer may right click the links and use open in new window, causing one token to be used many times. Will that work?)

Thanks!

jjw2015
  • 343
  • 4
  • 12
  • 1
    You almost certainly dont need 800 forms. Post some of your code – Martin Dawson Mar 28 '16 at 00:18
  • Possibly related: [Multiple @Html.AntiForgeryToken() in 2 different forms in one page?](http://stackoverflow.com/questions/12341725/is-it-possible-right-to-use-multiple-html-antiforgerytoken-in-2-different-for) | [Do I need to add separate Anti-Forgery Tokens in each form?](http://stackoverflow.com/questions/5887983/if-i-add-multiple-forms-in-a-single-page-do-i-need-to-add-separate-anti-forgery) | [ASP.NET MVC HTML.AntiForgeryToken() with multiple AJAX requests from one page](http://stackoverflow.com/questions/5227636/asp-net-mvc-html-antiforgerytoken-with-multiple-ajax-requests-from-one-page) – NightOwl888 Mar 28 '16 at 00:28
  • 1
    Do the 4 actions (links) actually cause a POST? The token is not used if they are actually just links with URL params (GETs). Having 800 forms will do you no good. – Bryan Lewis Mar 28 '16 at 00:38

0 Answers0