2023年6月20日发(作者：)

切记ajax中要带上AntiForgeryToken防⽌CSRF攻击经常看到在项⽬中ajax post数据到服务器不加防伪标记，造成CSRF攻击在 Mvc⾥加⼊防伪标记很简单在表单中加⼊rgeryToken()即可。rgeryToken()会⽣成⼀对加密的字符串，分别存放在Cookies 和 input 中。我们在ajax post中也带上AntiForgeryToken@model @{ = "Index";}

Index

Persen

@tionSummary(true, "", new { @class = "text-danger" })
@or(model => , htmlAttributes: new { @class = "control-label col-md-2" })
@For(model => , new { htmlAttributes = new { @class = "form-control" } }) @tionMessageFor(model => , "", new { @class = "text-danger" })
@or(model => , htmlAttributes: new { @class = "control-label col-md-2" })
@For(model => , new { htmlAttributes = new { @class = "form-control" } }) @tionMessageFor(model => , "", new { @class = "text-danger" })
放在cookies⾥⾯的加密字符串控制器中代码using System;using c;using ;using ;using ;using s;using ;namespace llers { public class HomeController : Controller { public ActionResult Index() { return View(); } [HttpPost] [MyValidateAntiForgeryToken] public ActionResult Index(Person p) { return Json(true, et); } } public class Person { public string Name { get; set; } public int Age { get; set; } } public class MyValidateAntiForgeryToken : AuthorizeAttribute { public override void OnAuthorization(AuthorizationContext filterContext) { var request = t; if (thod == ) {

if (Request()) { var antiForgeryCookie = s[Name]; var cookieValue = antiForgeryCookie != null : null; //从cookies 和 Headers 中 验证防伪标记 //这⾥可以加try-catch te(cookieValue, s["__RequestVerificationToken"]); } else { new ValidateAntiForgeryTokenAttribute() .OnAuthorization(filterContext); } } } } }这⾥注释掉ajax中防伪标记在请求$("#save").click(function () { $.ajax({ type: 'POST', url: '/Home/Index', cache: false, // headers: headers, data: { Name: "yangwen", Age: "1" }, success: function (data) { alert(data) }, error: function () { alert("Error") } });})默认返回500的状态码。这⾥修改ajax中的防伪标记 $(function () { //var token = $('[name=__RequestVerificationToken]'); //获取防伪标记 var token = $('@rgeryToken()').val(); var headers = {}; //防伪标记放⼊headers //也可以将防伪标记放⼊data headers["__RequestVerificationToken"] = token+11; $("#save").click(function () { $.ajax({ type: 'POST', url: '/Home/Index', cache: false, headers: headers, data: { Name: "yangwen", Age: "1" }, success: function (data) { alert(data) }, error: function () { alert("Error") } }); })})也是500的状态码。以上内容就是本⽂的全部叙述，切记ajax中要带上AntiForgeryToken防⽌CSRF攻击，⼩伙伴们在使⽤过程发现有疑问，请给我留⾔，谢谢！

2023年6月20日发(作者：)

切记ajax中要带上AntiForgeryToken防⽌CSRF攻击经常看到在项⽬中ajax post数据到服务器不加防伪标记，造成CSRF攻击在 Mvc⾥加⼊防伪标记很简单在表单中加⼊rgeryToken()即可。rgeryToken()会⽣成⼀对加密的字符串，分别存放在Cookies 和 input 中。我们在ajax post中也带上AntiForgeryToken@model @{ = "Index";}

Index

Persen

@tionSummary(true, "", new { @class = "text-danger" })
@or(model => , htmlAttributes: new { @class = "control-label col-md-2" })
@For(model => , new { htmlAttributes = new { @class = "form-control" } }) @tionMessageFor(model => , "", new { @class = "text-danger" })
@or(model => , htmlAttributes: new { @class = "control-label col-md-2" })
@For(model => , new { htmlAttributes = new { @class = "form-control" } }) @tionMessageFor(model => , "", new { @class = "text-danger" })
放在cookies⾥⾯的加密字符串控制器中代码using System;using c;using ;using ;using ;using s;using ;namespace llers { public class HomeController : Controller { public ActionResult Index() { return View(); } [HttpPost] [MyValidateAntiForgeryToken] public ActionResult Index(Person p) { return Json(true, et); } } public class Person { public string Name { get; set; } public int Age { get; set; } } public class MyValidateAntiForgeryToken : AuthorizeAttribute { public override void OnAuthorization(AuthorizationContext filterContext) { var request = t; if (thod == ) {

if (Request()) { var antiForgeryCookie = s[Name]; var cookieValue = antiForgeryCookie != null : null; //从cookies 和 Headers 中 验证防伪标记 //这⾥可以加try-catch te(cookieValue, s["__RequestVerificationToken"]); } else { new ValidateAntiForgeryTokenAttribute() .OnAuthorization(filterContext); } } } } }这⾥注释掉ajax中防伪标记在请求$("#save").click(function () { $.ajax({ type: 'POST', url: '/Home/Index', cache: false, // headers: headers, data: { Name: "yangwen", Age: "1" }, success: function (data) { alert(data) }, error: function () { alert("Error") } });})默认返回500的状态码。这⾥修改ajax中的防伪标记 $(function () { //var token = $('[name=__RequestVerificationToken]'); //获取防伪标记 var token = $('@rgeryToken()').val(); var headers = {}; //防伪标记放⼊headers //也可以将防伪标记放⼊data headers["__RequestVerificationToken"] = token+11; $("#save").click(function () { $.ajax({ type: 'POST', url: '/Home/Index', cache: false, headers: headers, data: { Name: "yangwen", Age: "1" }, success: function (data) { alert(data) }, error: function () { alert("Error") } }); })})也是500的状态码。以上内容就是本⽂的全部叙述，切记ajax中要带上AntiForgeryToken防⽌CSRF攻击，⼩伙伴们在使⽤过程发现有疑问，请给我留⾔，谢谢！