asp.net Core 1.1 Antiforgery mit eckigen 2/4

Question

Ich versuche, Anti-Roger-Token auf asp.net Core 1.1 mit Angurl 2/4 CLI zu implementieren, aber jedes Mal, wenn ich "ValidateAntiForgeryToken" -System verwende mir 400 Bad Anfragefehler.

in asp.net startup.cs ich habe

services.AddAntiforgery(options => options.HeaderName = "X-XSRF-TOKEN"); 



app.Use(async (context, next) =>{ 
await next(); 
string path = context.Request.Path.Value; 
if (path != null && !path.ToLower().Contains("/api")) 
{ 
     var tokens = antiforgery.GetAndStoreTokens(context); 
     context.Response.Cookies.Append("XSRF-TOKEN", 
     tokens.RequestToken, new CookieOptions{HttpOnly = false}); 
} 

if (context.Response.StatusCode == 404 && 
    !Path.HasExtension(context.Request.Path.Value)) 
{ 
    context.Request.Path = "/index.html"; 
    context.Response.StatusCode = 200; 
    await next(); 
} 

});

in Winkel app.module.ts Ich bin mit so etwas wie

provider:[{ provide: XSRFStrategy, useFactory: xsrfFactory}], 

export function xsrfFactory() { 
    return new CookieXSRFStrategy('*******', '********'); 
} 

Answer 1

Ist dieses Handbuch hilfreich? http://www.dotnetcurry.com/aspnet/1343/aspnet-core-csrf-antiforgery-token

public class AngularAntiforgeryCookieResultFilter: ResultFilterAttribute 
{ 
    private IAntiforgery antiforgery; 
    public AngularAntiforgeryCookieResultFilter(IAntiforgery antiforgery) 
    { 
     this.antiforgery = antiforgery; 
    } 

    public override void OnResultExecuting(ResultExecutingContext context) 
    { 
     if (context.Result is ViewResult) 
     { 
      var tokens = antiforgery.GetAndStoreTokens(context.HttpContext); 
      context.HttpContext.Response.Cookies.Append("XSRF-TOKEN", tokens.RequestToken, new CookieOptions() { HttpOnly = false }); 
     } 
    } 
} 

services.AddAntiforgery(opts => opts.HeaderName = "X-XSRF-Token"); 
services.AddMvc(opts => 
{ 
    opts.Filters.AddService(typeof(AngularAntiforgeryCookieResultFilter)); 
}); 
services.AddTransient<AngularAntiforgeryCookieResultFilter>();