How to call API with AntiForgeryToken using Postman in IdentityServer ASP.NET Core

Question

I'm trying to test my API with Identity Server Asp.net Core using Postman.

This is the way that I'm trying to do:

1. First request HttpGet to https://localhost:5000/Account/Login and in response body I received: <input name="__RequestVerificationToken" type="hidden" value="CfDJ8MoS9upoM4dNp8Kx-AdvA-uYr13_PAkuMZpzYMV8UmxZq5GdLTvN-Ht5NpTLmPtlhL5d5z2Hu2vUJoJGhk1AMlARDcOwqgq7Cef1dfQL_vl4tIFM4kx9RZPz8DHU26-U9qLnKAIstZgR42-1FuGNh24" />

And in Cookie (not sure for what it is though):

2. Then HttpPost to https://localhost:5000/Account/Login with RequestVerificationToken with token received from body HttpGet request.

And always error 400 as you can see at screen shot above.

In Visual studio I can see that some request was catched but clearly was incorrect.

If I'll remove attribute [ValidateAntiForgeryToken] then of course everything works fine but obviously because that validation is disabled.

Answer 1

You'd need to do followings to send such a request:

1.) Enter __RequestVerificationToken key value (don't forget double underscores) into x-www-form-urlencoded

2.) You need to add .AspNetCore.Antiforgery cookie to the Cookies section in Postman.

For example like this .AspNetCore.Antiforgery.1XHiLFgQI2w=your cookie value; Path=/; Domain=localhost;Expires=Session;

You can find .AspNetCore.Antiforgery cookie in Application section in Google Developer Tools

.AspNetCore.Antiforgery cookie in Google Developer Tools picture

Add cookie in Postman picture