Ignore ValidateAntiForgeryToken only for specific action

Question

for security reasons, i prefer to add the attribute ValidateAntiForgeryToken on top of my baseController so all the actions will be affected from that attribute.

I would like to disable that attribute only for single action.

not deriving for my baseController is not an option. unfortunately, ValidateAntiForgeryToken atribute is sealed class so i can't create my own customValidateAntiForgeryToken attribute based on the original ValidateAntiForgeryToken one.

Answer 1

You can disable the validation of anti-forgery tokens for an action by applying the [IgnoreAntiforgeryToken] attribute to a method.

[IgnoreAntiforgeryToken]
public IActionResult MyFunction()

Answer 2

It's true that the ValidateAntiForgeryToken class is sealed but it's not rocket science to roll our own:

public class MyValidateAntiForgeryTokenAttribute: FilterAttribute, IAuthorizationFilter
{
    public void OnAuthorization(AuthorizationContext filterContext)
    {
        System.Web.Helpers.AntiForgery.Validate();
    }
}

Now of course all that's left in our implementation is to add some check from the filterContext whether the current action is decorated with some custom ExcludeFromAntiForgeryValidation attribute and not call the Validate method.

Something along the lines of:

public class MyValidateAntiForgeryTokenAttribute: FilterAttribute, IAuthorizationFilter
{
    public void OnAuthorization(AuthorizationContext filterContext)
    {
        bool shouldValidate = !filterContext
            .ActionDescriptor
            .GetCustomAttributes(typeof(ExcludeFromAntiForgeryValidationAttribute), true)
            .Any();
        if (shouldValidate)
        {
            System.Web.Helpers.AntiForgery.Validate();
        }
    }
}

and then just write a custom attribute:

[AttributeUsage(AttributeTargets.Method)]
public class ExcludeFromAntiForgeryValidationAttribute : Attribute
{
}

that you would use to decorate your controller actions with for which you want to exclude antiforgery validation:

[HttpPost]
[ExcludeFromAntiForgeryValidation]
public ActionResult Index(MyViewModel model)
{
    ...
}