DotNetCore Using AntiForgeryToken in Header

Question

I am trying to send my HTTP requests as content-type:application/json. So, because my data sended as JSON, I also send AntiForgeryToken as JSON:

{
    "SearchValue": "ShiroiTora",
    "Filter": [
        {
            "FilterName": "DepartmentIdList",
            "FilterValue": [
                "1",
                "2",
                "3"
            ]
        }   
    ],
    "TotalCount": "1000",
    "PageNumber": "1",
    "OrderColumn": "Name"
},
//{
//  "__RequestVerificationToken": "*some_token_here"
//}

I asked here what should I do my code to understand JSON-ised AntiForgeryToken. I don't know whether it's possible or not, but as described in this site it looks like it's possible to send AntiForgeryToken value in header. But the code is written in .net mvc and I couldn't find any code written in ".net core 2.0". Also, I don't know much about "Attributes" so, it would be appreciated if someone could help me.

My Code (I am not sure if I should copy/paste code written in "that site" or not. So, I just copy/paste my code):

[HttpPost]
[ValidateAntiForgeryToken]
public IActionResult PhoneBook([FromBody]PersonnelFilterReq filterList)
{
    return Ok("FINALLY WORKED!!!!");
}

Model (used in POST method):

using System.Collections.Generic;

namespace GebzeShared.Modules.HR.Personnel.RequestModels
{
    /// <summary>
    /// Personel sayfaları için genel request metodu
    /// </summary>
    public class PersonnelFilterReq
    {
        /// <summary>
        /// Arama Değeri
        /// </summary>
        public string SearchValue { get; set; }

        /// <summary>
        /// Filtre Listesi
        /// </summary>
        public ICollection<FilterList> Filter { get; set; }

        /// <summary>
        /// 
        /// </summary>
        public int TotalCount { get; set; }

        /// <summary>
        /// 
        /// </summary>
        public int PageNumber { get; set; }

        /// <summary>
        /// 
        /// </summary>
        public string OrderColumn { get; set; }
    }

    /// <summary>
    /// 
    /// </summary>
    public class FilterList
    {
        /// <summary>
        /// Filterinin Adı
        /// </summary>
        public string FilterName { get; set; }

        /// <summary>
        /// Filtrenin Değeri
        /// </summary>
        public ICollection<string> FilterValue { get; set; }
    }
}

score 2 · Accepted Answer · answered Feb 13 '18 at 20:36

2

With ASP.NET MVC Core it is not necessary anymore to use a custom attribute as done on the site you refer to. It works out of the box now to set the token in the header of an ajax request. See example here

answered Feb 13 '18 at 20:36

hankor

390
2
6

DotNetCore Using AntiForgeryToken in Header

1 Answers1