Empty or invalid anti forgery header token
See original GitHub issuehttps://aspnetboilerplate.com/Pages/Documents/XSRF-CSRF-Protection#non-browser-clients
I upgraded from 5 -> 7 recently, and one of our endpoints (which is used by just an API client system, no browser) is broken and throwing this error in the log:
WARN 2022-01-31 16:46:23,317 [16 ] rity.AntiForgery.AbpAntiForgeryApiFilter - Empty or invalid anti forgery header token.
WARN 2022-01-31 16:46:23,317 [16 ] rity.AntiForgery.AbpAntiForgeryApiFilter - Requested URI: http://192.168.128.172/api/services/Project/csvHook/Check
I added the [DisableAbpAntiForgeryTokenValidation]
to the interface method and it works now, but still, the system was working before and now doesn’t (I was executing the API endpoint from the swagger pages)
Issue Analytics
- State:
- Created 2 years ago
- Comments:22 (22 by maintainers)
Top Results From Across the Web
400 Response (Empty or invalid anti forgery header token) ...
1. Issue When I make any POST request to the API it returns a 400 - Empty or invalid anti forgery header token...
Read more >Orchestrator throws error "empty or invalid anti forgery ...
Orchestrator throws error "empty or invalid anti forgery token" while logging in. · Open Chrome > Go to 'Dev Tools' > click on...
Read more >HTTP/1.1 400 Empty or invalid anti forgery header token
Performing a POST request and using NTLM auth receives '400 Empty or invalid anti forgery header token.' that forces me to remove the...
Read more >400 Empty or invalid anti forgery header token #5335
Hi, I'm using MVC5AJ1. I'm trying to send request by using Postman with following the ...
Read more >Anti-forgery token and anti-forgery cookie related issues
Anti -forgery token is used to prevent CSRF (Cross-Site Request Forgery) attacks. Here is how it works in high-level.
Read more >
Top Related Medium Post
No results found
Top Related StackOverflow Question
No results found
Troubleshoot Live Code
Lightrun enables developers to add logs, metrics and snapshots to live code - no restarts or redeploys required.
Start Free
Top Related Reddit Thread
No results found
Top Related Hackernoon Post
No results found
Top Related Tweet
No results found
Top Related Dev.to Post
No results found
Top Related Hashnode Post
No results found
I see, there is indeed an error in my console that it cannot get the injected script. perhaps the way it works have changed between 5-7 and I need to reinstall/config swagger.
I could not reproduce this issue on ASP.NET Core (nor ASP.NET MVC 5), so I doubt ASP.NET Core does that.
Also, @<span></span>worthy7 is asking about ABP on ASP.NET MVC 5.