Skip to main content

MVC 5 Web API 2 Token Based Authentication

MVC 5 Preventing Cross-Site Request Forgery(CSRF) Attacks


Table of Contents

1. In the 1st step add the function GetTokenHeader() to get token header.
2. In second step add the script code for post the ajax request with token header for API controller.
3. Add the ValidateAntiForgeryToken attribute for validate the antiforgery token on controller actions.
4. validate the all request using RequestVerificationToken and HttpRequestMessage.

                   The below video show the steps where put the codes



For more details seen the below example.

//Step 1
//Put the code in cshtml page
@{
    Models.UserSession userSession = (Models.UserSession)Session["userSession"];     
    @functions{
        public string GetTokenHeader()
        {
            string cookieToken, formToken;
            AntiForgery.GetTokens(null, out cookieToken, out formToken);
            return cookieToken + ":" + formToken;               
        }
    }
}
//Step 2 //This is script code put in cshtml page

//Step 3 //This is controller code.
[ValidateAntiForgeryToken]
[Route("API/Pricing/GetByCTID")]
public IHttpActionResult GetByCTID(HttpRequestMessage RequestMsg)
{
            var re = Request;
            var headers = re.Headers;
            int CompanyID = 0, TenantID = 0, CostCenterID = 0;
            //This methods is used for Validate Request Header.
            ValidateAllHeaderRequest(RequestMsg);
            if (headers.Contains("CompanyID"))
                CompanyID = Convert.ToInt32(headers.GetValues("CompanyID").First());
            if (headers.Contains("TenantID"))
                TenantID = Convert.ToInt32(headers.GetValues("TenantID").First());
            if (headers.Contains("CostCenterID"))
                CostCenterID = Convert.ToInt32(headers.GetValues("CostCenterID").First());
            ICollection pricing = mapper.MapDALPricings2BAL(objDalPricing.getAllPricingForConnect(CompanyID, TenantID, "N", CostCenterID));
            if (pricing == null)
            {
                return NotFound();
            }
            return Ok(pricing);
        }

//Step 4
// This method is used to validate header requests for each call.
  
void ValidateAllHeaderRequest(HttpRequestMessage request)
  {
            try
            {
                string cookieToken = string.Empty;
                string formToken = string.Empty;
                IEnumerable myTokenHeaders;
                bool tokenValue = request.Headers.TryGetValues("RequestVerificationToken",out myTokenHeaders);
                if (tokenValue)
                {
                    string[] tokens = myTokenHeaders.First().Split(':');
                    var myTokensLength = tokens.Length;
                    if (myTokensLength == 2)
                    {
                        cookieToken = tokens[0].Trim();
                        formToken = tokens[1].Trim();
                    }
                }
                AntiForgery.Validate(cookieToken, formToken);
            }
            catch (System.Web.Mvc.HttpAntiForgeryException ex)
            {
                throw new System.Web.Mvc.HttpAntiForgeryException("Anti forgery token cookie not found");
            }
        }

By Anil Singh | Rating of this article (*****)

Popular posts from this blog

nullinjectorerror no provider for httpclient angular 17

In Angular 17 where the standalone true option is set by default, the app.config.ts file is generated in src/app/ and provideHttpClient(). We can be added to the list of providers in app.config.ts Step 1:   To provide HttpClient in a standalone app we could do this in the app.config.ts file, app.config.ts: import { ApplicationConfig } from '@angular/core'; import { provideRouter } from '@angular/router'; import { routes } from './app.routes'; import { provideClientHydration } from '@angular/platform-browser'; //This (provideHttpClient) will help us to resolve the issue  import {provideHttpClient} from '@angular/common/http'; export const appConfig: ApplicationConfig = {   providers: [ provideRouter(routes),  provideClientHydration(), provideHttpClient ()      ] }; The appConfig const is used in the main.ts file, see the code, main.ts : import { bootstrapApplication } from '@angular/platform-browser'; import { appConfig } from ...

List of Countries, Nationalities and their Code In Excel File

Download JSON file for this List - Click on JSON file    Countries List, Nationalities and Code Excel ID Country Country Code Nationality Person 1 UNITED KINGDOM GB British a Briton 2 ARGENTINA AR Argentinian an Argentinian 3 AUSTRALIA AU Australian an Australian 4 BAHAMAS BS Bahamian a Bahamian 5 BELGIUM BE Belgian a Belgian 6 BRAZIL BR Brazilian a Brazilian 7 CANADA CA Canadian a Canadian 8 CHINA CN Chinese a Chinese 9 COLOMBIA CO Colombian a Colombian 10 CUBA CU Cuban a Cuban 11 DOMINICAN REPUBLIC DO Dominican a Dominican 12 ECUADOR EC Ecuadorean an Ecuadorean 13 EL SALVA...

Encryption and Decryption Data/Password in Angular

You can use crypto.js to encrypt data. We have used 'crypto-js'.   Follow the below steps, Steps 1 –  Install CryptoJS using below NPM commands in your project directory npm install crypto-js --save npm install @types/crypto-js –save After installing both above commands it looks like  – NPM Command  1 ->   npm install crypto-js --save NPM Command  2 ->   npm install @types/crypto-js --save Steps 2  - Add the script path in “ angular.json ” file. "scripts" : [                "../node_modules/crypto-js/crypto-js.js"               ] Steps 3 –  Create a service class “ EncrDecrService ” for  encrypts and decrypts get/set methods . Import “ CryptoJS ” in the service for using  encrypt and decrypt get/set methods . import  {  Injectable  }  from ...

How To convert JSON Object to String?

To convert JSON Object to String - To convert JSON Object to String in JavaScript using “JSON.stringify()”. Example – let myObject =[ 'A' , 'B' , 'C' , 'D' ] JSON . stringify ( myObject ); ü   Stayed Informed –   Object Oriented JavaScript Interview Questions I hope you are enjoying with this post! Please share with you friends!! Thank you!!!

Angular Testing Questions and Answers | 9, 8, 7, 6

What Is Testing? The testing is a tools and techniques for a unit and integration testing Angular applications . Why Test? Tests are the best ways to prevent software bugs and defects. How to Setup Test in Angular Project? Angular CLI install everything you need to test an Angular application. This CLI command takes care of Jasmine and karma configuration for you. Run this CLI command- ng test The test file extension must be “.spec.ts” so that tooling can identify the test file. You can also unit test your app using other testing libraries and test runners. Types of Test – The all great developer knows his/her testing tools use. Understanding your tools for testing is essential before diving into writing tests. The Testing depends on your project requirements and the project cost. The types of Testing looks like - 1.       Unit Test 2.       Integration Test 3.       En...