确认Ajax Post请求的URL和Action方法的地址匹配。
在Startup.cs文件中,添加以下代码片段以启用Csrf保护:
services.AddAntiforgery(options =>
{
options.HeaderName = "X-CSRF-TOKEN";
});
$(document).ready(function () {
var token = $('input[name="__RequestVerificationToken"]').val();
$.ajax({
url: "/controller/action",
type: "POST",
data: {
__RequestVerificationToken: token,
...
},
success: function (result) {
...
}
});
});
public void Configure(IApplicationBuilder app, IWebHostEnvironment env)
{
app.Use(async (context, next) =>
{
if (context.Request.Headers.ContainsKey("X-Requested-With") &&
context.Request.Headers["X-Requested-With"] == "XMLHttpRequest")
{
context.Request.Headers.Add("Referer", "/");
}
await next();
});
...
}