43 lines
998 B
Plaintext
43 lines
998 B
Plaintext
|
include::../description.adoc[]
|
||
|
|
|
||
|
|
include::../ask-yourself.adoc[]
|
||
|
|
|
||
|
|
include::../recommended.adoc[]
|
||
|
|
|
||
|
|
== Noncompliant Code Example
|
||
|
|
|
||
|
|
----
|
||
|
|
public void ConfigureServices(IServiceCollection services)
|
||
|
|
{
|
||
|
|
// ...
|
||
|
|
services.AddControllersWithViews(options => options.Filters.Add(new IgnoreAntiforgeryTokenAttribute())); // Sensitive
|
||
|
|
// ...
|
||
|
|
}
|
||
|
|
----
|
||
|
|
|
||
|
|
----
|
||
|
|
[HttpPost, IgnoreAntiforgeryToken] // Sensitive
|
||
|
|
public IActionResult ChangeEmail(ChangeEmailModel model) => View("~/Views/...");
|
||
|
|
----
|
||
|
|
|
||
|
|
== Compliant Solution
|
||
|
|
|
||
|
|
----
|
||
|
|
public void ConfigureServices(IServiceCollection services)
|
||
|
|
{
|
||
|
|
// ...
|
||
|
|
services.AddControllersWithViews(options => options.Filters.Add(new AutoValidateAntiforgeryTokenAttribute()));
|
||
|
|
// or
|
||
|
|
services.AddControllersWithViews(options => options.Filters.Add(new ValidateAntiForgeryTokenAttribute()));
|
||
|
|
// ...
|
||
|
|
}
|
||
|
|
----
|
||
|
|
|
||
|
|
----
|
||
|
|
[HttpPost]
|
||
|
|
[AutoValidateAntiforgeryToken]
|
||
|
|
public IActionResult ChangeEmail(ChangeEmailModel model) => View("~/Views/...");
|
||
|
|
----
|
||
|
|
|
||
|
|
include::../see.adoc[]
|