asp.net mvc 4 - MVC4 AntiForgery token cookie name is appended with random string -
i encountering issue mvc4's
@html.antiforgerytoken()
html helper. on development machine, when run project, upon inspecting headers (using fiddler) , name of token returned is
__requestverificationtoken
but when deployed iis version 7.5 (windows 2008 r2), token name looks like:
__requestverificationtoken_l2v6b3jkzxi1
where getting changed? because application not deployed "root folder" of iis? e.g. application deployed
"http://myserver/myapp" instead of "http://myserver"
i found answer after looking @ source code:
http://aspnetwebstack.codeplex.com/sourcecontrol/latest#src/system.web.webpages/helpers/antiforgeryconfig.cs
yes, because application deployed path, following code below appends encoded equivalent of path... hope finding save trouble.
// if app path provided, we're generating cookie name rather field name, , cookie names should // unique development server cookie , iis cookie - both running on localhost - don't stomp on // each other. internal static string getantiforgerycookiename(string apppath) { if (string.isnullorempty(apppath) || apppath == "/") { return antiforgerytokenfieldname; } else { return antiforgerytokenfieldname + "_" + httpserverutility.urltokenencode(encoding.utf8.getbytes(apppath)); } }
Comments
Post a Comment