2

AntiForgeryToken is present on my form under MVC 5 solution. and it is working good. But I my client got some refer web site, if my domain,for example, is www.mysite.com their URL is www.mysite.blabla.com.

if user open normal web site it is working good, but if in case he opened www.mysite.blabla.com and make SUBMIT (POST) form, I am getting error The required anti-forgery cookie "__RequestVerificationToken" is not present.

In elmah logs I see next values

HTTP_HOST   www.mysite.com 

HTTP_REFERER    http://www.mysite.blabla.com/

HTTP_X_FORWARDED_HOST www.mysite.blabla.com

HTTP_X_FORWARDED_SERVER www.mysite.blabla.com

SERVER_NAME www.mysite.com

I need to allow to use my work on this domain. Is it possible to setAnto-Forgety Token to allow reqvest to this domaine ? or it is only one solution : remove

@Html.AntiForgeryToken()

Arbejdsglæde
  • 13,670
  • 26
  • 78
  • 144

1 Answers1

0

The goal of the AnitForgeryToken is to prevent other sites from posting to your actions. This is expected behavior. It prevents cross-site request forgery attacks.

If they want to link over, it should be with a standard GET request.

ps2goat
  • 8,067
  • 1
  • 35
  • 68