angularjs $http.post 到带有 [ValidateAntiForgeryToken] 的 MVC 控制器

Question

使用 [ValidateAntiForgeryToken] 从 Angular 到 MVC 控制器的 $http.post 方法会引发 500 内部服务器错误，并显示以下消息。 [我们调用控制器在标头中传递 __RequestVerificationToken 以及数据。] 我们正在使用 Microsoft.AspNet.Mvc-6.0.0-beta4

<span class="light exception">System.InvalidOperationException</span><br />
<span class="heavy">Incorrect Content-Type: application/json;charset=UTF-8</span><br />
<div class="stacktrace">
<pre><span class="faded">at Microsoft.AspNet.Http.Core.</span>FormFeature.&lt;ReadFormAsync&gt;d__12.MoveNext<span class="faded">
;()</span></pre>
    <br /><pre><span class="faded">at System.Runtime.CompilerServices.</span>TaskAwaiter.ThrowForNonSuccess<span class="faded">(Task task)</span></pre>
    <br /><pre><span class="faded">at System.Runtime.CompilerServices.</span>TaskAwaiter.HandleNonSuccessAndDebuggerNotification<span class="faded">(Task task)</span></pre>
    <br /><pre><span class="faded">at System.Runtime.CompilerServices.</span>TaskAwaiter&lt;TResult&gt;.GetResult<span class="faded">()</span></pre>
    <br /><pre><span class="faded">at Microsoft.AspNet.Mvc.</span>AntiForgeryTokenStore.&lt;GetFormTokenAsync&gt;d__4.MoveNext<span class="faded">()</span></pre>

Answer 1

我为此编写了一个自定义验证属性（适用于 beta4）。 像普通的一样使用它。

public class ValidateAntiForgeryTokenFromHeaderAttribute : ActionFilterAttribute, IFilter {
    public override void OnActionExecuting (ActionExecutingContext actionContext) {
        if (actionContext == null) throw new ArgumentNullException(nameof(actionContext));

        base.OnActionExecuting(actionContext);

        AntiForgery antiForgery = actionContext.HttpContext.ApplicationServices.GetService(typeof(AntiForgery)) as AntiForgery;

        var options = actionContext.HttpContext.ApplicationServices.GetService(typeof(IOptions<MvcOptions>)) as IOptions<MvcOptions>;
        var config = options.Options.AntiForgeryOptions;

        var request = actionContext.HttpContext.Request;

        String cookieToken = request.Cookies[config.CookieName];
        String formToken   = request.Headers.Get("X-XSRF-Token");

        antiForgery.Validate(actionContext.HttpContext, cookieToken, formToken);
    }
}

在angular中，我在app的run方法中设置$http如下：

$http.defaults
     .headers
     .common[$http.defaults.xsrfHeaderName] = angular.element("input[name='__RequestVerificationToken']")
                                                     .attr("value");