使用 AntiForgeryToken 发送 HTTP 标头后，服务器无法附加标头

Question

我正在使用 C# 和 Twitter Bootstrap 构建我的第一个网站，我在帖子中收到“服务器无法在发送 HTTP 标头后附加标头”错误，同时发现验证问题并且需要显示 TempData["ErrorMessage"]在return View(model) 之后。具体错误发生在html行@Html.AntiForgeryToken()。如果在验证之外设置消息并返回到视图，则不会发生错误。

我尝试过：将return View(model) 更改为RedirectToAction ("Action", new { id = model.id }) 和Redirect ("/Controller/Action/" + model.id.ToString())，如果行在验证之外，它们会起作用，但在条件验证内部时会失败；在Application_start 中将AntiForgeryConfig.SuppressXFrameOptionsHeader 设置为true；并在设置 TempData 并返回视图之前调用 HttpContext.Response.Clear()。我还没有尝试操作 cookie，因为我不确定如何专门处理防伪令牌。

我想要做的就是返回视图，并在页面上显示错误/验证消息，而不是作为弹出消息框，并且上述方法均无效。有谁知道为什么这个目标在验证之外有效，但在验证内部无效？非常感谢！

//Any return and message works correctly if done here
try
{
    //Various other validations using values pulled from database

    if (model.NewString.Length > 50 || model.NewString.Length < 7)
    {
        //This throws the error
        TempData["ErrorMessage"] = "Please enter a value of valid length.";
        return View(model);
    }
}
catch
{
    TempData["ErrorMessage"] = "There has been an error.";
    return RedirectToAction("Index");
}

编辑：这是按照 Amit 的要求执行的操作。

[HttpPost]
[ValidateAntiForgeryToken]
[Authorize (Roles = "Administrator, Owner, Director, Manager")]
[RequireSsl]
public ActionResult CreateCustomer (CreateCustomerModel model)
{
    dbEntities db = new dbEntities();

    var CurrentBusinessID = 0;
    var CurrentPosition = "";
    var CurrentUserID = 0;

    try
    {
        if (Session["CurrentUserID"] != null)
        {
            CurrentUserID = (int)Session["CurrentUserID"];
            CurrentBusinessID = (int)Session["CurrentBusinessInfoID"];
            CurrentPosition = (string)Session["CurrentPosition"];
        }
        else
        {
            Response.Redirect("/Account/Logon");
        }
    }
    catch (Exception ex)
    {
        Console.WriteLine(ex);
        Response.Redirect("/Account/Logon");
    }

    try
    {
        var account = db.uspGetAccount(model.AccountID).FirstOrDefault();
        AccountsModel thisAccount = new AccountsModel()
        {
            AccountID = model.AccountID,
            BusinessID = account.BusinessID
        };
        if (thisAccount.BusinessID != CurrentBusinessID)
        {
            Response.Redirect("/Home/Dashboard");
        }

        if (model.Name == null || model.Name == "")
        {
            TempData["ErrorMessage"] = "Please enter a name.";
            return View(model);
        }
        if (model.NewString.Length > 50 || model.NewString.Length < 7)
        {
            //This throws the error
            TempData["ErrorMessage"] = "Please enter a value of valid length.";
            return View(model);
        }

        db.AddCustomer(model.Name, model.NewString);
    }
    catch
    {
        TempData["ErrorMessage"] = "There has been an error.";
        return RedirectToAction("Index");
    }

    return RedirectToAction("Accounts");
}

Answer 1

通过在包含验证的try 语句中更改if 语句中的Reponse.Redirect("/Home/Dashboard") 解决了这个问题。更改此行以返回 RedirectToAction("Accounts") 解决了问题，虽然我不知道为什么。

if (thisAccount.BusinessID != CurrentBusinessID)
{
    Response.Redirect("/Home/Dashboard");//Solve the problem by replacing this
}