How to set cookie path for AntiforgeryToken in case of asp.net mvc application?

Question

Can any help me to know how to set AntiforgeryToken cookie path for asp.net mvc4 application?

I followed the MSDN article: https://learn.microsoft.com/en-us/aspnet/mvc/overview/security/xsrfcsrf-prevention-in-aspnet-mvc-and-web-pages

but there is nothing mentioned in it containing how to set the cookie path.

Any code sample will help in this case.

Please go through this url https://learn.microsoft.com/en-us/previous-versions/ms178194(v=vs.140)?redirectedfrom=MSDN — Dharmeshsharma, Dec 10 '19 at 07:20
Thanks @Dharmeshsharma for your response. This cookie is different compared to the default asp.net cookies. — santosh kumar patro, Dec 10 '19 at 07:23

score 0 · Answer 1 · answered Dec 10 '19 at 07:30

In my application startup.cs, i can set my cookie path as below this may help you .

public void ConfigureAuth(IAppBuilder app)
    {
        // Configure the db context, user manager and signin manager to use a single instance per request
        app.CreatePerOwinContext(ApplicationDbContext.Create);
        app.CreatePerOwinContext<ApplicationUserManager>(ApplicationUserManager.Create);
        app.CreatePerOwinContext<ApplicationSignInManager>(ApplicationSignInManager.Create);

        // Enable the application to use a cookie to store information for the signed in user
        // and to use a cookie to temporarily store information about a user logging in with a third party login provider
        // Configure the sign in cookie
        app.UseCookieAuthentication(new CookieAuthenticationOptions
        {
            AuthenticationType = DefaultAuthenticationTypes.ApplicationCookie,
            LoginPath = new PathString("/Home"),
            Provider = new CookieAuthenticationProvider
            {
                // Enables the application to validate the security stamp when the user logs in.
                // This is a security feature which is used when you change a password or add an external login to your account.  
                OnValidateIdentity = SecurityStampValidator.OnValidateIdentity<ApplicationUserManager, ApplicationUser>(
                    validateInterval: TimeSpan.FromMinutes(30),
                    regenerateIdentity: (manager, user) => user.GenerateUserIdentityAsync(manager))
            },
            CookieDomain = "",
            CookieName = "cookieName",
            CookiePath = "/"


        });            
        app.UseExternalSignInCookie(DefaultAuthenticationTypes.ExternalCookie);

        // Enables the application to temporarily store user information when they are verifying the second factor in the two-factor authentication process.
        app.UseTwoFactorSignInCookie(DefaultAuthenticationTypes.TwoFactorCookie, TimeSpan.FromMinutes(5));

        // Enables the application to remember the second login verification factor such as phone or email.
        // Once you check this option, your second step of verification during the login process will be remembered on the device where you logged in from.
        // This is similar to the RememberMe option when you log in.
        app.UseTwoFactorRememberBrowserCookie(DefaultAuthenticationTypes.TwoFactorRememberBrowserCookie);

        // Uncomment the following lines to enable logging in with third party login providers
        //app.UseMicrosoftAccountAuthentication(
        //    clientId: "",
        //    clientSecret: "");

        //app.UseTwitterAuthentication(
        //   consumerKey: "",
        //   consumerSecret: "");

        //app.UseFacebookAuthentication(
        //   appId: "",
        //   appSecret: "");

        //app.UseGoogleAuthentication(new GoogleOAuth2AuthenticationOptions()
        //{
        //    ClientId = "",
        //    ClientSecret = ""
        //});
    }

The above code snippet is about the cookie generated as part of authentication process. Whereas in my case I am trying to set the path for the cookie that is generated as part of the Antiforgerytoken. — santosh kumar patro, Dec 10 '19 at 10:38

Dailosrs · Answer 2 · 2021-10-31T16:42:03.043

It is possible to configure the cookie path with encapsulation.

public static class AntiForgeryTokenExtensions
{
    ///<summary>
    ///Generates a hidden form field (anti-forgery token) that is 
    ///validated when the form is submitted. Furthermore, this extension 
    ///applies custom settings on the generated cookie. 
    ///</summary>
    ///<returns>Generated form field (anti-forgery token).</returns>
    public static MvcHtmlString AntiForgeryTokenExtension(this HtmlHelper html)
    {
        // Call base AntiForgeryToken and save its output to return later.
        var output = html.AntiForgeryToken();
        
        // Check that cookie exists
        if(HttpContext.Current.Response.Cookies.AllKeys.Contains(AntiForgeryConfig.CookieName))
        {
            // Set cookie into the variable
            var antiForgeryTokenCookie = HttpContext.Current.Response.Cookies.Get(AntiForgeryConfig.CookieName);
            
            // Set cookie configuration
            antiForgeryTokenCookie.Path = "/Path";
            // antiForgeryTokenCookie.HttpOnly = true;
            // ...
        }
        
        return output;
    }
}

If more details are needed it is explained deeper in my post in this question.

SOURCE

How to set the AntiForgeryToken cookie path

How to set cookie path for AntiforgeryToken in case of asp.net mvc application?

2 Answers2