3

I am working with visual studio 2015 and aspnetcore rc2. I use @html.antiforgerytoken() in every form to post. But mvc 6 creates the first one and removes (or ignores,maybe) the others. I tried this with masterview and without master, no result. I am thinking that I have a mistake somewhere but where? I have cleared browser history and created a simple empty asp.net project with one view and one controller, tried again and no result again.

Here are the screenshots.

enter image description here output enter image description here I do not use @addtaghelper or any other similiar extentions, I just use @html.antiforgerytoken.

Phiter
  • 13,983
  • 14
  • 50
  • 82
ergen
  • 85
  • 2
  • 10
  • i use this style for now, this is a particular solution not an answer: @{ if(viewdata["token"]==null){html.antiforgerytoken();} } and @viewdata["token"] inside form. – ergen Jun 04 '16 at 23:24

2 Answers2

1

Github repo aspnet/MVC have a bunch of issues about multiple AntiForgeryToken calls: #319, #4595, #4924. It seems that current behavior is a "effect" of previous bug. Opened #5005.

Currently (as of 1.0.0 RTM) we have workaround: save generated token to variable and write this variable multiple times:

@{
    var token = Html.AntiForgeryToken();
}
<form id="form-one">
    @token
</form>
<form id="form-two">
    @token
</form>

Update: Issue #5005 confirmed as bug, scheduled for 1.1.0 milestone.

Dmitry
  • 14,925
  • 4
  • 57
  • 71
0

As I mentioned in #5005, this situation occurs only when HTML and tag helpers are not used to generate the <form> element.

Other than switching to HTML generation i.e. using more invasive helpers, the easiest workaround is to add the following in your _ViewImports.cshtml:

@addTagHelper *, Microsoft.AspNetCore.Mvc.TagHelpers

or

@addTagHelper Microsoft.AspNetCore.Mvc.TagHelpers.RenderAtEndOfFormTagHelper, Microsoft.AspNetCore.Mvc.TagHelpers
Doug
  • 101
  • 2
  • thank you for your response. as i mentioned in the question, I do not (want to) use @addtaghelper or any other similiar extentions – ergen Jul 13 '16 at 18:08
  • 1
    That's fine @ergen, it's a temporary workaround. We plan to fix [#5005](https://github.com/aspnet/Mvc/issues/5005) in our next release. – Doug Jul 14 '16 at 19:40