Spa Angular Template 2.0.0 and Antiforgery #234

New Issue

fergalmoran · 2025-08-09T17:15:31Z

fergalmoran commented

2025-08-09 17:15:31 +00:00

Originally created by @robfarmergt on 1/10/2018

I'm trying to test Antiforgery and can't seem to get it to work. It doesn't look like the cookie is being appended to the request. When using the following code:

app.Use(next => context =>
{
    if (
        string.Equals(context.Request.Path.Value, "/", StringComparison.OrdinalIgnoreCase) ||
        string.Equals(context.Request.Path.Value, "/index.html", StringComparison.OrdinalIgnoreCase))
    {
        // We can send the request token as a JavaScript-readable cookie, and Angular will use it by default.
        var tokens = antiforgery.GetAndStoreTokens(context);
        context.Response.Cookies.Append("XSRF-TOKEN", tokens.RequestToken,
            new CookieOptions() { HttpOnly = false });
    }

    return next(context);
});

From what I can tell the cookie should get attached to a request for either / or /index.html but it isn't.

I'm also not entirely sure how the new Spa services handle requests as it seems like ng serve is running a server as well as IIS Express.

Any help is appreciated.

*Originally created by @robfarmergt on 1/10/2018* I'm trying to test [Antiforgery](https://docs.microsoft.com/en-us/aspnet/core/security/anti-request-forgery) and can't seem to get it to work. It doesn't look like the cookie is being appended to the request. When using the following code: ``` app.Use(next => context => { if ( string.Equals(context.Request.Path.Value, "/", StringComparison.OrdinalIgnoreCase) || string.Equals(context.Request.Path.Value, "/index.html", StringComparison.OrdinalIgnoreCase)) { // We can send the request token as a JavaScript-readable cookie, and Angular will use it by default. var tokens = antiforgery.GetAndStoreTokens(context); context.Response.Cookies.Append("XSRF-TOKEN", tokens.RequestToken, new CookieOptions() { HttpOnly = false }); } return next(context); }); ``` From what I can tell the cookie should get attached to a request for either `/` or `/index.html` but it isn't. I'm also not entirely sure how the new Spa services handle requests as it seems like `ng serve` is running a server as well as `IIS Express`. Any help is appreciated.

fergalmoran closed this issue

2025-08-09 17:15:31 +00:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: github/JavaScriptServices#234