What is the Antiforgerytoken?

Question

What is the AntiForgeryToken and what it serves as in an ASP.NET MVC application?

Answer 1

Is a method which generates and inserts into the HTML generated in view a code to prevent data sending to the server from being falsified.

When using this method he inserts something like this:

<input name="__RequestVerificationToken" type="hidden"
    value="saTFWpkKN0BYazFtN6c4YbZAmsEwG0srqlUqqloi/fVgeV2ciIFVmelvzwRZpArs" />

I put in the Github for future reference.

When the form is sent with this code it is possible to validate whether it was generated by the current session. The attribute ValidateAntiForgeryToken is used to validate in the controller.

It solves some types of attack like CSRF, but not all.

Answer 2

In case you need to pass the information via AJAX with jQuery can do so:~

var token = $('input[name="__RequestVerificationToken"]', form).val();

$.ajax({
    url: "/Controller/Action",
    type: "POST",
    data: {
        __RequestVerificationToken: token,
        IdAnuncio: $("#IdAnuncio").val(),
        Quantidade: quantidade,
        ValorCompra: valorCompra.toFixed(2)
    },
    success: function (data, textStatus, xhr) {
    }
});