Styjun

Gravitational Force Between Numbers

Natural Armour and Weapons

Why did Jon Snow do this immoral act if he is so honorable?

How to deal with a colleague who is being aggressive?

Why does the hash of infinity have the digits of π?

Drums and punctuation

Is keeping the forking link on a true fork necessary (Github/GPL)?

What is the meaning of "<&3" and "done < file11 3< file22"

Is it legal to have an abortion in another state or abroad?

Can I tell a prospective employee that everyone in the team is leaving?

Manager questioning my time estimates for a project

How to keep consistency across the application architecture as a team grows?

Can a character with the War Caster feat call a bolt with Call Lightning instead of making an opportunity attack?

Need to read my home electrical Meter

便利な工具 what does な means

Time complexity of an algorithm: Is it important to state the base of the logarithm?

How to melt snow without fire or body heat?

Why did other houses not demand this?

What is the view of Buddhism in correcting others' view in spite of their willingness to accept it?

Why does Bran want to find Drogon?

Which European Languages are not Indo-European?

How was Daenerys able to legitimise this character?

Are runways booked by airlines to land their planes?

When playing Edgar Markov, what is the definition of a "Vampire spell"?

Need ALL 3 “RequestVerificationToken”, “XSRF-TOKEN”, AND “X-XSRF-TOKEN” headers set otherwise get 'not set' error

ASP.NET 5 (vNext) - Getting a Configuration SettingGet info for all current Autofac-managed instancesHow to implement X-XSRF-TOKEN with angular2 app and net core app?XSRF-TOKEN not updated when using IISExpress and localhostImplementing XSRF-Token in ASP.Net Core with SPA Prerendering and JWT Bearer AuthenticationXsrf Token conflicts with Jwt TokenAngular 6 CORS with XSRF on Net.Core not requesting all headersASP.NET Core HttpClient accept all certificates for localhost only, otherwise behave normallyAsp.Net Core I'm getting 404 error problemWhy do i need to set a DefaultForbidScheme

.everyoneloves__top-leaderboard:empty,.everyoneloves__mid-leaderboard:empty,.everyoneloves__bot-mid-leaderboard:empty height:90px;width:728px;box-sizing:border-box;

0

What am I doing wrong here? I need to set three different formats of the XSRF headers whenever I make a POST from the page.

Everything is working fine when I do this but how did I get into this situation where I have to even do this? I feel like I've wired up some part of the project incorrectly possibly? Or is this normal now?

I have a <form> tag on my page. And the JS is being called via a jquery on("click") event.

The JS:

$.ajax(
 method: "POST",
 dataType: "json",
 data: JSON.stringify( availsProps: dataObj ),
 beforeSend: function (xhr) 
 var xsrf = $('input:hidden[name="__RequestVerificationToken"]').val();
 xhr.setRequestHeader("RequestVerificationToken", xsrf);
 xhr.setRequestHeader("XSRF-TOKEN", xsrf);
 xhr.setRequestHeader("X-XSRF-TOKEN", xsrf);
 ,
 url: "/Freelancers/Calendar?handler=CalendarClick",
 contentType:"application/json",
 processData: false
);

In my startup I've tried adding services.AddAntiforgery or not. My POST handler requires all 3 Headers to be set no matter what.

 services.AddAntiforgery(options =>
 
 options.HeaderName = "X-XSRF-TOKEN";
 );

In Configure:

public void Configure(IApplicationBuilder app, IHostingEnvironment env)

 if (env.IsDevelopment())
 
 app.UseDeveloperExceptionPage();
 app.UseDatabaseErrorPage();
 
 else
 
 app.UseExceptionHandler("/Error");
 // The default HSTS value is 30 days. You may want to change this for production scenarios, see https://aka.ms/aspnetcore-hsts.
 app.UseHsts();
 

 app.UseHttpsRedirection();

 app.UseDefaultFiles();
 app.UseStaticFiles();

 app.UseCookiePolicy();

 app.UseAuthentication();

 app.UseMvc();

If I unset any one of the xhr headers then I get the classic The required antiforgery header value "RequestVerificationToken" OR "XSRF-TOKEN" OR "X-XSRF-TOKEN" is not present

asp.net-core .net-core

share|improve this question

asked Mar 24 at 0:20

Ryan VetezeRyan Veteze

310618

add a comment | 

0

What am I doing wrong here? I need to set three different formats of the XSRF headers whenever I make a POST from the page.

Everything is working fine when I do this but how did I get into this situation where I have to even do this? I feel like I've wired up some part of the project incorrectly possibly? Or is this normal now?

I have a <form> tag on my page. And the JS is being called via a jquery on("click") event.

The JS:

$.ajax(
 method: "POST",
 dataType: "json",
 data: JSON.stringify( availsProps: dataObj ),
 beforeSend: function (xhr) 
 var xsrf = $('input:hidden[name="__RequestVerificationToken"]').val();
 xhr.setRequestHeader("RequestVerificationToken", xsrf);
 xhr.setRequestHeader("XSRF-TOKEN", xsrf);
 xhr.setRequestHeader("X-XSRF-TOKEN", xsrf);
 ,
 url: "/Freelancers/Calendar?handler=CalendarClick",
 contentType:"application/json",
 processData: false
);

In my startup I've tried adding services.AddAntiforgery or not. My POST handler requires all 3 Headers to be set no matter what.

 services.AddAntiforgery(options =>
 
 options.HeaderName = "X-XSRF-TOKEN";
 );

In Configure:

public void Configure(IApplicationBuilder app, IHostingEnvironment env)

 if (env.IsDevelopment())
 
 app.UseDeveloperExceptionPage();
 app.UseDatabaseErrorPage();
 
 else
 
 app.UseExceptionHandler("/Error");
 // The default HSTS value is 30 days. You may want to change this for production scenarios, see https://aka.ms/aspnetcore-hsts.
 app.UseHsts();
 

 app.UseHttpsRedirection();

 app.UseDefaultFiles();
 app.UseStaticFiles();

 app.UseCookiePolicy();

 app.UseAuthentication();

 app.UseMvc();

If I unset any one of the xhr headers then I get the classic The required antiforgery header value "RequestVerificationToken" OR "XSRF-TOKEN" OR "X-XSRF-TOKEN" is not present

asp.net-core .net-core

share|improve this question

asked Mar 24 at 0:20

Ryan VetezeRyan Veteze

310618

add a comment | 

What am I doing wrong here? I need to set three different formats of the XSRF headers whenever I make a POST from the page.

Everything is working fine when I do this but how did I get into this situation where I have to even do this? I feel like I've wired up some part of the project incorrectly possibly? Or is this normal now?

I have a <form> tag on my page. And the JS is being called via a jquery on("click") event.

The JS:

$.ajax(
 method: "POST",
 dataType: "json",
 data: JSON.stringify( availsProps: dataObj ),
 beforeSend: function (xhr) 
 var xsrf = $('input:hidden[name="__RequestVerificationToken"]').val();
 xhr.setRequestHeader("RequestVerificationToken", xsrf);
 xhr.setRequestHeader("XSRF-TOKEN", xsrf);
 xhr.setRequestHeader("X-XSRF-TOKEN", xsrf);
 ,
 url: "/Freelancers/Calendar?handler=CalendarClick",
 contentType:"application/json",
 processData: false
);

In my startup I've tried adding services.AddAntiforgery or not. My POST handler requires all 3 Headers to be set no matter what.

 services.AddAntiforgery(options =>
 
 options.HeaderName = "X-XSRF-TOKEN";
 );

In Configure:

public void Configure(IApplicationBuilder app, IHostingEnvironment env)

 if (env.IsDevelopment())
 
 app.UseDeveloperExceptionPage();
 app.UseDatabaseErrorPage();
 
 else
 
 app.UseExceptionHandler("/Error");
 // The default HSTS value is 30 days. You may want to change this for production scenarios, see https://aka.ms/aspnetcore-hsts.
 app.UseHsts();
 

 app.UseHttpsRedirection();

 app.UseDefaultFiles();
 app.UseStaticFiles();

 app.UseCookiePolicy();

 app.UseAuthentication();

 app.UseMvc();

If I unset any one of the xhr headers then I get the classic The required antiforgery header value "RequestVerificationToken" OR "XSRF-TOKEN" OR "X-XSRF-TOKEN" is not present

asp.net-core .net-core

share|improve this question

asked Mar 24 at 0:20

Ryan VetezeRyan Veteze

310618

$.ajax(
 method: "POST",
 dataType: "json",
 data: JSON.stringify( availsProps: dataObj ),
 beforeSend: function (xhr) 
 var xsrf = $('input:hidden[name="__RequestVerificationToken"]').val();
 xhr.setRequestHeader("RequestVerificationToken", xsrf);
 xhr.setRequestHeader("XSRF-TOKEN", xsrf);
 xhr.setRequestHeader("X-XSRF-TOKEN", xsrf);
 ,
 url: "/Freelancers/Calendar?handler=CalendarClick",
 contentType:"application/json",
 processData: false
);

 services.AddAntiforgery(options =>
 
 options.HeaderName = "X-XSRF-TOKEN";
 );

public void Configure(IApplicationBuilder app, IHostingEnvironment env)

 if (env.IsDevelopment())
 
 app.UseDeveloperExceptionPage();
 app.UseDatabaseErrorPage();
 
 else
 
 app.UseExceptionHandler("/Error");
 // The default HSTS value is 30 days. You may want to change this for production scenarios, see https://aka.ms/aspnetcore-hsts.
 app.UseHsts();
 

 app.UseHttpsRedirection();

 app.UseDefaultFiles();
 app.UseStaticFiles();

 app.UseCookiePolicy();

 app.UseAuthentication();

 app.UseMvc();

share|improve this question

asked Mar 24 at 0:20

Ryan VetezeRyan Veteze

310618

share|improve this question

asked Mar 24 at 0:20

Ryan VetezeRyan Veteze

310618

asked Mar 24 at 0:20

Ryan VetezeRyan Veteze

310618

asked Mar 24 at 0:20

Ryan VetezeRyan Veteze

310618