51 lines
1.1 KiB
Plaintext
51 lines
1.1 KiB
Plaintext
include::../description.adoc[]
|
|
|
|
include::../ask-yourself.adoc[]
|
|
|
|
include::../recommended.adoc[]
|
|
|
|
== Noncompliant Code Example
|
|
|
|
----
|
|
public void ConfigureServices(IServiceCollection services)
|
|
{
|
|
// ...
|
|
services.AddControllersWithViews(options => options.Filters.Add(new IgnoreAntiforgeryTokenAttribute())); // Sensitive
|
|
// ...
|
|
}
|
|
----
|
|
|
|
----
|
|
[HttpPost, IgnoreAntiforgeryToken] // Sensitive
|
|
public IActionResult ChangeEmail(ChangeEmailModel model) => View("~/Views/...");
|
|
----
|
|
|
|
== Compliant Solution
|
|
|
|
----
|
|
public void ConfigureServices(IServiceCollection services)
|
|
{
|
|
// ...
|
|
services.AddControllersWithViews(options => options.Filters.Add(new AutoValidateAntiforgeryTokenAttribute()));
|
|
// or
|
|
services.AddControllersWithViews(options => options.Filters.Add(new ValidateAntiForgeryTokenAttribute()));
|
|
// ...
|
|
}
|
|
----
|
|
|
|
----
|
|
[HttpPost]
|
|
[AutoValidateAntiforgeryToken]
|
|
public IActionResult ChangeEmail(ChangeEmailModel model) => View("~/Views/...");
|
|
----
|
|
|
|
include::../see.adoc[]
|
|
|
|
ifdef::env-github,rspecator-view[]
|
|
'''
|
|
== Comments And Links
|
|
(visible only on this page)
|
|
|
|
include::comments-and-links.adoc[]
|
|
endif::env-github,rspecator-view[]
|