为什么AntiForgeryToken验证一直失败? [英] Why AntiForgeryToken validation keeps failing?

问题描述

我正在开发使用asp.net core2和Angular运行的Web API应用程序.详细的开发环境配置为此处. 我正在尝试配置AntiForgeryToken验证，但是它一直失败.我按照配置进行操作. 此处，但我必须对其进行修改因为我的角度应用程序和asp.net服务器在两个不同的端口上运行，因为前端启动不会生成令牌.我通过在应用程序组件ngOnInit上调用API路径(/api/Account/ContactInitialization)启动后端，这使我可以生成令牌. 配置如下所示，

I am developing a web API app running using asp.net core2 and Angular. The detailed development environment config is here. I am trying to configure AntiForgeryToken validation but it keeps failing. I followed the config. here, but I had to modify it as my angular app and asp.net servers are running on two different ports because the front end startup doesn't generate the token. I kick start the backend by calling an API path (/api/Account/ContactInitialization) at the app component ngOnInit which allowed me to generate the token. The config is shown below,

IServiceCollection服务:

        services.AddAntiforgery(options =>
                {
                    options.HeaderName = "X-CSRF-TOKEN";
                    options.SuppressXFrameOptionsHeader = false;
                });

和IApplicationBuilder Configure:

app.Use(next => context =>
                {
                    string path = context.Request.Path.Value;
                    if (

                        string.Equals(path, "/", StringComparison.OrdinalIgnoreCase) ||
                        string.Equals(path, "/api/Account/ContactInitialization", StringComparison.OrdinalIgnoreCase) ||
                        string.Equals(path, "/index.html", StringComparison.OrdinalIgnoreCase))
                    {
                        // We can send the request token as a JavaScript-readable cookie, 
                        // and Angular will use it by default.
                         var tokens = antiforgery.GetAndStoreTokens(context);
                        context.Response.Cookies.Append("XSRF-TOKEN", tokens.RequestToken,
                            new CookieOptions() { HttpOnly = false });
                    }

                    return next(context);
                });

asp.net.生成两组密钥，

asp.net. generates two set of keys,

我用[ValidateAntiForgeryToken]装饰了我的方法，并在标题请求中包含了XSRF-TOKEN cookie内容.调用API后，我仍然收到400 (Bad Request)响应！我在这里想念什么?

I decorated my method with [ValidateAntiForgeryToken] and I included XSRF-TOKEN cookie content in my header request. yet I keep receiving a 400 (Bad Request) response after calling the API! what am I missing here?

控制器方法，

    [Authorize]
    [ValidateAntiForgeryToken]
    [HttpPost]
    public IEnumerable<string> AutherizeCookie()
    {
        return new string[] { "Hello", "Auth Cookie" };
    }

我的详细标头请求如下所示，

my detailed header request looks like below,

推荐答案

我假设您可能遵循了

I'm assuming you probably followed the documentation, but glossed over the pertinent bits. What you've done so far works only for Angular, because Angular's $http will actually add the X-XSRF-TOKEN header based on the XSRF-TOKEN cookie. (Note, however, that even then, you've set your header as X-CSRF-TOKEN, which won't actually work here. It needs to be X-XSRF-TOKEN).

但是，如果您不使用Angular，则有责任自己在AJAX请求中设置标头，而您可能会忽略这样做.在这种情况下，您实际上不需要更改任何防伪令牌配置(标题名称，设置cookie等).您只需要提供标题为RequestVerificationToken.例如，使用jQuery:

However, if you're not using Angular, you're responsible for setting the header yourself in your AJAX requests, which you likely are neglecting to do. In this case, you don't actually need to change any of the antiforgery token config (header names, setting cookies, etc.). You simply need to provide the header as RequestVerificationToken. For example, with jQuery:

$.ajax({
    ...
    headers:
    {
        "RequestVerificationToken": '@GetAntiXsrfRequestToken()'
    },
    ...
});

这将在视图中适用于JavaScript.如果需要在外部JS中执行此操作，则需要设置cookie，以便可以从cookie中获取值.除此之外，适用相同的方法.

That will work for JavaScript in view. If you need to do this in external JS, then you would need to set the cookie, so that you can get at the value from the cookie instead. Other than that, the same methodology applies.

如果只想更改标题名称，则可以进行更改；您只需要将此处的RequestVerificationHeader部分更改为相同的值即可.

If you simply want to change the header name, you can do so; you just need to change the RequestVerificationHeader portion here to the same value.

这篇关于为什么AntiForgeryToken验证一直失败?的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！