Why does adding AutoValidateAntiForgeryTokenAttribute by type not work?

Question

In ASP.NET Core you can validate all non-GET requests by including this line in Startup.cs (docs):

services.AddMvc(options => options.Filters.Add(new AutoValidateAntiforgeryTokenAttribute()));

However, if you add the filter by type (using typeof or the generic Add<T> method), the validation doesn't seem to work:

// Doesn't work
services.AddMvc(options => options.Filters.Add(typeof(AutoValidateAntiforgeryTokenAttribute));
// Doesn't work either
services.AddMvc(options => options.Filters.Add<AutoValidateAntiforgeryTokenAttribute>());

See https://github.com/davidgruar/GlobalFilterDemo for a minimal repro.

What is going on here?

Answer 1

You need to register the type with the DI container. I just tried and it works.

public void ConfigureServices(IServiceCollection services)
{
    services.AddMvc(options =>
    {
        // This works
        //options.Filters.Add(new AutoValidateAntiforgeryTokenAttribute());

        // These variants don't work
        //options.Filters.Add<AutoValidateAntiforgeryTokenAttribute>();
        options.Filters.Add(typeof(AutoValidateAntiforgeryTokenAttribute));
    });

    services.AddScoped<AutoValidateAntiforgeryTokenAttribute>();
}