Antiforgery integration for minimal APIs #173

Rick-Anderson · 2023-08-14T22:44:16Z

See Antiforgery integration for minimal APIs

In this code I pass in the action so

app.MapGet("/DisableAntiforgery", () =>
{
    return Results.Content(MyHtml.html("/todo"), "text/html");
});

app.MapGet("/post2", () =>
{
    return Results.Content(MyHtml.html("/todo2"), "text/html");
});

Can use the same HTML when they pass in the action arg.

Is there a clean way to do this to pass in an arg for

<input name="{token.FormFieldName}" 
                              type="hidden" value="{token.RequestToken}" />

Maybe that makes things too messy. Perhaps I should duplicate most of the HTML and not get the HTML from a method while passing the action.

public static string html2(string action, AntiforgeryTokenSet token) => $"""
    <html><body>
        <form action="{action}" method="POST" enctype="multipart/form-data">
            <input name="{token.FormFieldName}" 
                          type="hidden" value="{token.RequestToken}" />
            <input type="text" name="name" />
            <input type="date" name="dueDate" />
            <input type="checkbox" name="isCompleted" />
            <input type="submit" />
        </form>
    </body></html>
""";

Works, but I'm not sure it's an improvement. There's no way to pass in a null token.

@sammychinedu2ky @david-acker

cc @guardrex

The text was updated successfully, but these errors were encountered:

sammychinedu2ky · 2023-08-15T04:55:36Z

I think this works @Rick-Anderson

using Microsoft.AspNetCore.Antiforgery;
using Microsoft.AspNetCore.Mvc;

var builder = WebApplication.CreateBuilder();

builder.Services.AddAntiforgery();

var app = builder.Build();

app.MapGet("/antiforgery", (HttpContext context, IAntiforgery antiforgery) =>
{
    var token = antiforgery.GetAndStoreTokens(context);
    return Results.Content(MyHtml.html("/todo", token), "text/html");
});

app.MapGet("/non-antiforgery", () =>
{
    Console.WriteLine("nonantiforgery");
    return Results.Content(MyHtml.html("/todo2"), "text/html");
});

app.MapPost("/todo", ([FromForm] Todo todo) => Results.Ok(todo));

app.MapPost("/todo2", ([FromForm] Todo todo) => Results.Ok(todo))
                                                .DisableAntiforgery();

app.Run();

class Todo
{
    public required string Name { get; set; }
    public bool IsCompleted { get; set; }
    public DateTime DueDate { get; set; }
}

public static class MyHtml
{

    public static string html(string action, AntiforgeryTokenSet token = null)
    {
        var forgeryInputField = token is null ?
        "" : generateTokenField(token);
        return $"""
    <html><body>
        <form action="{action}" method="POST" enctype="multipart/form-data">
            {forgeryInputField}
            <input type="text" name="name" />
            <input type="date" name="dueDate" />
            <input type="checkbox" name="isCompleted" />
            <input type="submit" />
        </form>
    </body></html>
""";
    }

    public static string generateTokenField(AntiforgeryTokenSet token) => $"""
        <input name="{token.FormFieldName}" 
                      type="hidden" value="{token.RequestToken}" />
    """;
}

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Antiforgery integration for minimal APIs #173

Antiforgery integration for minimal APIs #173

Rick-Anderson commented Aug 14, 2023 •

edited

Loading

sammychinedu2ky commented Aug 15, 2023

Antiforgery integration for minimal APIs #173

Antiforgery integration for minimal APIs #173

Comments

Rick-Anderson commented Aug 14, 2023 • edited Loading

sammychinedu2ky commented Aug 15, 2023

Rick-Anderson commented Aug 14, 2023 •

edited

Loading