jQuery Ajax calls and the Html.AntiForgeryToken()

前端 未结 20 2378
鱼传尺愫
鱼传尺愫 2020-11-22 16:34

I have implemented in my app the mitigation to CSRF attacks following the informations that I have read on some blog post around the internet. In particular these post have

20条回答
  •  孤街浪徒
    2020-11-22 17:33

    I use a simple js function like this

    AddAntiForgeryToken = function(data) {
        data.__RequestVerificationToken = $('#__AjaxAntiForgeryForm input[name=__RequestVerificationToken]').val();
        return data;
    };
    

    Since every form on a page will have the same value for the token, just put something like this in your top-most master page

    <%-- used for ajax in AddAntiForgeryToken() --%>
    
    <%= Html.AntiForgeryToken()%>

    Then in your ajax call do (edited to match your second example)

    $.ajax({
        type: "post",
        dataType: "html",
        url: $(this).attr("rel"),
        data: AddAntiForgeryToken({ id: parseInt($(this).attr("title")) }),
        success: function (response) {
            // ....
        }
    });
    

提交回复
热议问题