kocoded/oqtane.framework
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

resolve antiforgery issue

Browse Source
This commit is contained in:
sbwalker 2024-01-31 07:33:52 -05:00
parent 82d7b9cf05
commit 7e817a5808
2 changed files with 5 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
Oqtane.Server/Components/App.razor
View File

@ -1,6 +1,7 @@
@namespace Oqtane.Components
@using Microsoft.AspNetCore.Http
@using Microsoft.AspNetCore.Http.Extensions
@using Microsoft.AspNetCore.Antiforgery
@using Oqtane.Client
@using Oqtane.Client.Utilities
@using Oqtane.Repository
@ -11,6 +12,7 @@
@using Oqtane.Themes
@using System.Net
@using Microsoft.AspNetCore.Localization
@inject IAntiforgery Antiforgery;
@inject IConfigManager ConfigManager;
@inject ITenantManager TenantManager;
@inject ILocalizationManager LocalizationManager;
@ -42,7 +44,7 @@
<body>
@if (string.IsNullOrEmpty(_message))
{
<Routes AntiForgeryToken="" Runtime="Server" RenderMode="PreRendered" VisitorId="-1" RemoteIPAddress="@_remoteIPAddress" AuthorizationToken="" @rendermode="@RenderModes.GetRenderMode(_interactiveRenderMode)" />
<Routes AntiForgeryToken="@_antiForgeryToken" Runtime="Server" RenderMode="PreRendered" VisitorId="-1" RemoteIPAddress="@_remoteIPAddress" AuthorizationToken="" @rendermode="@RenderModes.GetRenderMode(_interactiveRenderMode)" />
<script src="js/interop.js"></script>
<script src="_framework/blazor.web.js"></script>
@ -67,6 +69,7 @@
@code {
private string _interactiveRenderMode = "InteractiveServer";
private string _language = "en";
private string _antiForgeryToken = "";
private string _remoteIPAddress = "";
private string _headResources = "";
private string _bodyResources = "";
@ -81,6 +84,7 @@
protected override void OnInitialized()
{
_antiForgeryToken = Antiforgery.GetAndStoreTokens(Context).RequestToken;
_remoteIPAddress = Context.Connection.RemoteIpAddress?.ToString() ?? "";
// if framework is installed

2
Oqtane.Server/Security/AutoValidateAntiforgeryTokenFilter.cs
View File

@ -50,8 +50,6 @@ namespace Oqtane.Security
protected virtual bool ShouldValidate(AuthorizationFilterContext context)
{
return false;
// ignore antiforgery validation if a bearer token was provided
if (context.HttpContext.Request.Headers.ContainsKey("Authorization"))
{