ValidateAntiForgeryToken投掷错误

所需防伪表单字段“__RequestVerificationToken”不存在。

但是这正是我在做什么

与测试用户进行登录

VIEW

@using (Html.BeginForm(new { ReturnUrl = ViewBag.ReturnUrl })) 
{ 
     @Html.AntiForgeryToken() 
     @Html.ValidationSummary() 

     <fieldset> 
      <legend>Log in Form</legend> 
      <ol> 
       <li> 
        @Html.LabelFor(m => m.UserName) 
        @Html.TextBoxFor(m => m.UserName) 
       </li> 

       <li> 
        @Html.LabelFor(m => m.Password) 
        @Html.PasswordFor(m => m.Password) 
       </li> 

       <li> 
        @Html.LabelFor(m => m.RememberMe) 
        @Html.CheckBoxFor(m => m.RememberMe) 
       </li>

控制器

[AllowAnonymous] 
     [HttpPost] 
     [ValidateAntiForgeryToken] 
     public ActionResult Login(LoginModel model, string returnUrl) 
     { 
      if (ModelState.IsValid) 
      { 
       if (Membership.ValidateUser(model.UserName, model.Password)) 
       {      
        FormsAuthentication.SetAuthCookie(model.UserName, model.RememberMe); 

        return RedirectToCreateUserProfile(model, returnUrl); 
       } 
       else 
       { 
        ModelState.AddModelError("", "The user name or password provided is incorrect."); 
       }

一次验证我正在重定向到主页
然后我上一个菜单选项单击给我看用户个人资料，我得到上述错误

布局视图（显示更多的代码需要但想要使JS出现问题）

<!DOCTYPE html> 
<html> 
    <head> 
     <title>@ViewBag.Title</title> 
     <link href="@Url.Content("~/Content/Site.css")" rel="stylesheet" type="text/css" /> 
     <link href="@Url.Content("~/Content/kendo/2013.2.918/kendo.common.min.css")" rel="stylesheet" type="text/css" /> 
     <link href="@Url.Content("~/Content/kendo/2013.2.918/kendo.dataviz.min.css")" rel="stylesheet" type="text/css" /> 
     <link href="@Url.Content("~/Content/kendo/2013.2.918/kendo.metro.min.css")" rel="stylesheet" type="text/css" /> 
     <link href="@Url.Content("~/Content/kendo/2013.2.918/kendo.dataviz.metro.min.css")" rel="stylesheet" type="text/css" /> 
     <script src="@Url.Content("~/Scripts/kendo/2013.2.918/jquery.min.js")"></script> 
     <script src="@Url.Content("~/Scripts/kendo/2013.2.918/kendo.all.min.js")"></script> 
     <script src="@Url.Content("~/Scripts/kendo/2013.2.918/kendo.aspnetmvc.min.js")"></script> 
     <script src="@Url.Content("~/Scripts/kendo.modernizr.custom.js")"></script> 
     <script type="text/javascript"> 

      var _gaq = _gaq || []; 
      var pluginUrl = 
      '//www.google-analytics.com/plugins/ga/inpage_linkid.js'; 
      _gaq.push(['_require', 'inpage_linkid', pluginUrl]); 
      _gaq.push(['_setAccount', 'UA-44529127-1']); 
      _gaq.push(['_trackPageview']); 

      (function() { 
       var ga = document.createElement('script'); ga.type = 'text/javascript'; ga.async = true; 
       ga.src = ('https:' == document.location.protocol ? 'https://ssl' : 'http://www') + '.google-analytics.com/ga.js'; 
       var s = document.getElementsByTagName('script')[0]; s.parentNode.insertBefore(ga, s); 
      })(); 

</script> 

    </head> 
    <body> 
     <header> 
      <div class="content-wrapper"> 
       <div class="float-left"> 
        <p class="site-title">@Html.ActionLink("your logo here", "Index", "Home")</p> 
       </div> 
       <div class="float-right"> 
        <section id="login"> 
         @Html.Partial("_LoginPartial") 
        </section> 
        <nav> 
         <ul id="menu"> 
          <li>@Html.ActionLink("Home", "Index", "Home")</li> 
          <li>@Html.ActionLink("About", "About", "Home")</li> 
          <li>@Html.ActionLink("Contact", "Contact", "Home")</li> 
          @if (User.IsInRole("Admin")) 
          { 
           <li>@Html.ActionLink("API", "Index", "Help", new { area = "" }, null)</li>        
          } 
         </ul> 
        </nav>      
       </div> 
      </div> 
     </header> 
     <div id="body"> 
      @if (Request.IsAuthenticated) 
      { 
      <ul id="IndexHomeMenu"> 
       @if (User.IsInRole("Admin")) 
       { 
        <li> 
         [email protected]*@Html.ActionLink("Administration", "Contact", "Home")*@ 
         <ul> 
          <li>@Html.ActionLink("Manage Roles", "Index", "AdminView")</li> 
          <li>@Html.ActionLink("Manage Users", "Contact", "Home")</li> 
          <li>@Html.ActionLink("Inactive Reasons", "Index", "InactiveReasonView")</li> 
         </ul> 
        </li> 
       } 
       <li> 
        My Information 
        <ul> 
         <li>@Html.ActionLink("Profile", "EditByName", "UserView", new { UserName = User.Identity.Name }, new { @class = "selected" })</li> 
         <li>@Html.ActionLink("Phone Numbers", "Active", "PhoneNumberView",new {userName= User.Identity.Name },null)</li> 
         <li>@Html.ActionLink("Address's", "Active", "AddressView",new {userName= User.Identity.Name },null)</li> 
         @if(!User.IsInRole("Clients")){ 
         <li>@Html.ActionLink("Subscription", "Index", "AdminView")</li>} 
        </ul>

我点击

@ Html.ActionLink（ “资料”， “EditByName”， “用户视图”，新的{用户名= User.Identity.Name}，新的{@class = “选择”}）

CONTROLLER

[ValidateAntiForgeryToken] 
    public ActionResult EditByName(string userName)//EditByName 
    { 
     if (User.Identity.IsAuthenticated) 
     { 
      UserModel usermodel = repository.Get(User.Identity.Name);// db.UserModels.Find(id); 
      if (usermodel == null) 
      { 
       return RedirectToAction("Create","UserView", User.Identity.Name); 
      } 
      return View(usermodel); 
     } 
     else { return RedirectToAction("Login", controllerName: "AccountView"); } 
    }

这是当发生错误。我不知道什么是缺少的，我创建的令牌，它是在所有的形式。

来源

2013-10-08 ChampChris

您正在使用GET操作（EditByName操作）上的[ValidateAntiForgeryToken]，而其目的是处理POST操作。

看到这个question在[ValidateAntiForgeryToken]目的和这article解释如何防止使用它的CSRF攻击。

来源

2013-10-08 12:15:49

从EditByNameGET-action方法中删除[ValidateAntiForgeryToken]。

此外，使用[Authorize] atrribute而不是if (User.Identity.IsAuthenticated)。

并且可能任何用户编辑任何配置文件，只要他们知道用户名？

来源

2013-10-08 12:14:00 CodeCaster

只有ADMIN角色的用户可以编辑/查看任何配置文件 – ChampChris

而且我确实在控制器的顶部有[Authorize] – ChampChris

ValidateAntiForgeryToken投掷错误

回答

相关问题