CODEWITHSUNDEEP
angularjsasp.net-core-mvc
Rob
Rob

Reputation: 5588

ASP.NET 5 vNext Forms Having Anti Forgery Tokens Added

I'm experiencing an issue where a simple form tag is having an action and method attribute added to it. Also added are some hidden input fields for what I am guessing is anti-forgery.

Here is the html I'm adding in the Razor View:

<form>test</form>

And here's what's being rendered:

<form action="/company/adduser" method="post" class="ng-pristine ng-valid">
    test
    <input name="__RequestVerificationToken" type="hidden" value="CfDJ8KMbFT4ebnROrEREXkL-MYlPSgL0ISe6_sqTJXc982ocoWgKH1v_yCV2_5Qa9h8AmVFaNk0i0Wpa6gQlhWY-PHkZ929_Tkv1B-lCR7-aLyd53L2448CLQNtakb-UHQmLgPGCiQF0dj4jij9lc_sS7jRPjcGFnNjxdT_wobz-CsU3NvR-fm-a9r0MnqhflgwLLw">
</form>

It's causing major issues since I'm only using asp.net MVC to serve up HTML and using AngularJS on the client. The action methods is causing issues with angular when trying to use ng-submit.

Does anyone know:

  1. Is MVC somehow automatically adding anti-forgery tokens?
  2. How do I disable this?

Upvotes: 1

Views: 453

Answers (2)

Rob
Rob

Reputation: 5588

Problem here is that Microsoft added new TagHelpers and one of them is <form>. It seems to be adding all that extra "stuff".

Edit and better fix:

I ended up configuring TagHelpers to have a prefix. In my _GlobalImport.cshtml I added:

@addTagHelper "*, Microsoft.AspNet.Mvc.TagHelpers"
@tagHelperPrefix "asp:"

This allowed me to add "asp:" in front of any TagHelpers I did want to render. This also prevented the <form> tags from being rendered by the TagHelper.

I was notified by Damien Edwards on the ASP.NET team at Microsoft that the issue with the form tag is a bug and will be fixed. I still thought this information would be helpful in the meantime.

You can also prevent a TagHelper from rendering by adding a ! in front like so: <!form></!form>

Upvotes: 1

Scott Hanselman
Scott Hanselman

Reputation: 17702

As of the time of this writing, that's just a bug in the Form tag helper. It will be fixed.

You can exclude Form (or any element) from taghelper processing by adding a ! as in <!form></!form>

Upvotes: 6

Related Questions