This repository was archived by the owner on Dec 13, 2018. It is now read-only.
This repository was archived by the owner on Dec 13, 2018. It is now read-only.
AntiForgeryValidation attribute seems to conflict with CookieAuthenticationEvents OnRedirectToLogin event handler #1009
Description
Reposting from https://forums.asp.net/t/2101587.aspx,
From Vincent H,
Hi,
My app is based on the SDK: 1.0.0-preview2-003121 and uses a combination of MVC, Web API and AngularJs (v1)
When making API calls, I want to return a 401 unauthorized when the cookie based session has expired. I have adjusted the "Startup.cs" to include an "OnRedirectToLogin" event handler so that API calls can be intercepted to return 401.
However when the API controller is decorated with the "[ValidateAntiForgeryToken]", the cookie authentication event is never fired and a 400 bad request is returned instead.
Can someone assist me?
Here is my "Startup.cs" > "ConfigureServices" code:
services.AddIdentity<ApplicationUser, ApplicationRole>(config => { config.User.RequireUniqueEmail = true; config.Password.RequiredLength = 8; config.Cookies.ApplicationCookie.CookieSecure = CookieSecurePolicy.SameAsRequest; config.Cookies.ApplicationCookie.ExpireTimeSpan = TimeSpan.FromMinutes(5); config.Cookies.ApplicationCookie.LoginPath = "/account/login"; config.Cookies.ApplicationCookie.LogoutPath = "/account/logout"; config.Cookies.ApplicationCookie.Events = new CookieAuthenticationEvents { OnRedirectToLogin = ctx => { if (ctx.Request.Path.StartsWithSegments("/api") && ctx.Response.StatusCode == (int)HttpStatusCode.OK) { ctx.Response.StatusCode = (int)HttpStatusCode.Unauthorized; return Task.FromResult(ctx.RedirectUri); } else { ctx.Response.Redirect(ctx.RedirectUri); } return Task.FromResult(0); } }; }); And this is the "Startup.cs" > "Configure" code for the AntiForgeryValidation support:
app.UseIdentity(); app.Use(next => context => { if (context.Request.Path.Value.ToLower().Equals("/") || context.Request.Path.Value.ToLower().StartsWith("/home")) { var tokens = antiforgery.GetAndStoreTokens(context); context.Response.Cookies.Append("XSRF-TOKEN", tokens.RequestToken, new CookieOptions() { HttpOnly = false }); } return next(context); });