Mvc: RazorPage endpoints don't respect IgnoreAntiforgeryToken

[ryanbrandenburg]

If you add "OnPost" to a PageModel (like this one) and decorate it with [IgnoreAntiforgeryToken] it will still attempt to validate Antiforgery.

[ryanbrandenburg]

According to @rynowak having attributes on these handlers isn't going to be possible.

[verysimplenick]

@rynowak , @ryanbrandenburg
Okay, that I can do that simulate [IgnoreAntiforgeryToken] behaviour in razor pages?

[pranavkm]

@verysimplenick you should be able to annotate your Page model with the attribute and it should work now.

[verysimplenick]

@pranavkm
yep, I already tried

    [IgnoreAntiforgeryToken(Order = 1000)]
    public class OfferModel : PageModel 

But it's not working.

[pranavkm]

The validate antiforgery attribute that gets applied has an order of 1000 - https://github.com/aspnet/Mvc/blob/dev/src/Microsoft.AspNetCore.Mvc.ViewFeatures/AutoValidateAntiforgeryTokenAttribute.cs#L40 so you might need a higher Order for IgnoreAntiforgeryToken to become effective. Could you bump it up (to 1001)?

[verysimplenick]

@pranavkm Yes, it's works with Order > 1000, thanks.
Maybe need add it to docs of Razor Pages.