I have a very strange problem trying to implement XSRF in ASP.Net Core on angular $http post calls.
POST Register is working correctly and has the following signature:
[HttpPost("Register")]
[ValidateAntiForgeryToken]
public async Task<IActionResult> PostRegister([FromBody]AccountRegisterPostRequest req)
However POST Logout returns 400 with the same signature:
[HttpPost("Logout")]
[ValidateAntiForgeryToken]
public async Task<IActionResult> PostLogout()
{
return Ok();
}
ConfigureServices:
services.AddAntiforgery(options => options.HeaderName = "X-XSRF-TOKEN");
services.AddMvc();
services.Configure<MvcOptions>(c => c.Filters.Add(new RequireHttpsAttribute()));
Configure:
app.Use(next => context =>
{
if (string.Equals(context.Request.Path.Value, "/", StringComparison.OrdinalIgnoreCase))
{
var tokens = antiforgery.GetAndStoreTokens(context);
context.Response.Cookies.Append("XSRF-TOKEN", tokens.RequestToken,
new CookieOptions() { HttpOnly = false });
}
return next(context);
});
app.UseStaticFiles();
The angular call looks like this:
$http.post("/api/Account/Logout")
.then(function (result) {
console.log(result);
})
The API is in a seperate project in same solution. Help :)
