0

I am using an Angular SPA which calls multiple Asp.Net Core APIs. I need to enable Antiforgeryvalidation in all APIs and all requests should be validated.

   1.) Products API hosted mydomain.com/api/products - standalone API
   2.) Customers API hosted mydomain.com/api/customers - standalone API
   3.) Clientapp hosted as mydomain.com/clientapp - SPA

Token generated and appended to cookie (Product API) is failing on customer API calls. Token is generated on server side and appended as cookie on startup.cs and added to all HTTP request headers from clientside. But it works only on one API, the other API rejects token generated for previous API

Token Generation

app.Use(async (context, next) =>
            {
                if (context == null)
                {
                    throw new ArgumentNullException(nameof(context));
                }

                if (
                    string.Equals(context.Request.Path.Value, "/token/gentoken", StringComparison.OrdinalIgnoreCase))
                {
                    antiforgery.SetCookieTokenAndHeader(context);
                    var tokens = antiforgery.GetAndStoreTokens(context);
                    context.Response.Cookies.Append("XSRF-TOKEN", tokens.RequestToken,
                        new CookieOptions()
                        {
                            HttpOnly = false,                         
                        });
                }

            await next();
        });

Token Validation

services.AddAntiforgery
  (options =>
            {
                options.HeaderName = "x-xsrf-token";
                options.SuppressXFrameOptionsHeader = false;
                options.Cookie.HttpOnly = false;
               
            });

How can I use single token for multiple APIs and validate it ?

1
  • This looks like a programming question - you're asking how to use an API - not a security question. (A security question might be "how can I prevent CSRF in ASP.NET?" which, honestly, the default antiforgery system is overkill for. Just adding and checking for the existence of a custom header is sufficient, unless you're badly abusing CORS, in which case nothing except possibly SameSite will save you.) This question might be better suited to StackOverflow.
    – CBHacking
    Apr 14 at 7:17

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.