Html.AntiForgeryToken辅助函数有什么作用? [英] What is the Html.AntiForgeryToken helper function for?

问题描述

有人可以告诉我更多细节吗?

Can somebody tell me more details about it?

推荐答案

基本上，防伪令牌可阻止任何人向由您的站点提交的请求，这些请求是由实际用户未生成的恶意脚本生成的.有一个仅HTTP的cookie(浏览器中运行的脚本不可读，但是浏览器发送并可以由服务器访问)发送到客户端，它用于生成隐藏字段值，然后针对该隐藏字段值进行验证曲奇饼.至少我认为就是这样.

Basically the anti forgery tokens stop anyone from submitting requests to your site that are generated by a malicious script not generated by the actual user. There is an HTTP only cookie (not readable by a script running in the browser, but sent by the browser and accessible by the server) that gets sent to the client, it is used to generate a hidden field value which is then validated against the cookie. At least I think that's the process.

这里有一个很好的描述，这正是您要问的 https://blogs.msmvps.com/luisabreu/blog/2009/02/09/the-mvc-platform-the-new-anti-forgery-token/

There is a good description of this here which is exactly what you are asking about https://blogs.msmvps.com/luisabreu/blog/2009/02/09/the-mvc-platform-the-new-anti-forgery-token/

这篇关于Html.AntiForgeryToken辅助函数有什么作用?的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！