Ajax post with C# Handler and XSRF-TOKEN

Joseph Kashishian 65

This question is for Web pages with .NET, C#, and Ajax.

I'm having an issue with a ajax calling working with the XSRF-TOKEN" and it's not calling the handler in the .CS. I think I need to do something with my ajax call to validate the token.

In my startup I have

        var antiforgery = app.ApplicationServices.GetRequiredService<IAntiforgery>();

        app.Use((context, next) =>

        {

            var requestPath = context.Request.Path.Value;

            if (string.Equals(requestPath, "/", StringComparison.OrdinalIgnoreCase)

                || string.Equals(requestPath, "/index.html", StringComparison.OrdinalIgnoreCase))

            {

                var tokenSet = antiforgery.GetAndStoreTokens(context);

                context.Response.Cookies.Append("XSRF-TOKEN", tokenSet.RequestToken!,

                    new CookieOptions { HttpOnly = false });

            }

            return next(context);

        });

index cs

using System.IO;

using System.Data.SqlClient;

using System.Collections.Generic;

using Microsoft.AspNetCore.Http;

using Microsoft.Extensions.Configuration;

using Microsoft.AspNetCore.Mvc.RazorPages;

using Microsoft.AspNetCore.Mvc;

using System;

namespace RecoveryHouse.Pages.ReferralRequest

{

public class IndexModel : PageModel

{

    public void OnGet()

    {

    }

    [HttpPost]

    [ValidateAntiForgeryToken]

    public IActionResult OnPostGetTime(string name)

    {

        PersonModel person = new PersonModel

        {

            Name = name,

            DateTime = DateTime.Now.ToString()

        };

        return new JsonResult(person);

    }

}

}

public class PersonModel

{

/// <summary>

/// Gets or sets Name.

/// </summary>

public string Name { get; set; }

/// <summary>

/// Gets or sets DateTime.

/// </summary>

public string DateTime { get; set; }

}

Index CSHTML

@page

@model RecoveryHouse.Pages.ReferralRequest.IndexModel

@addTagHelper*, Microsoft.AspNetCore.Mvc.TagHelpers

<!DOCTYPE html>

<html>

<head>

<meta name="viewport" content="width=device-width" />

<title>Index</title>

</head>

<body>

@Html.AntiForgeryToken()

<input type="text" id="txtName" />

<input type="button" id="btnGet" value="Get Current Time" />

<script type="text/javascript" src="https://cdnjs.cloudflare.com/ajax/libs/jquery/3.7.1/jquery.min.js"></script> 

<script type="text/javascript">

    $(function () {

        $("#btnGet").click(function () {

            $.ajax({

                type: "POST",

                url: "/Index?handler=GetTime",

                beforeSend: function (xhr) {

                    xhr.setRequestHeader("XSRF-TOKEN",

                        $('input:hidden[name="__RequestVerificationToken"]').val());

                },

                data: {"name": $("#txtName").val() },

                success: function (response) {

                    alert("Hello: " + response.Name + ".\nCurrent Date and Time: " + response.DateTime);

                },

                error: function (response) {

                    alert(response.responseText);

                }

            });

        });

    });

</script>

</body>

</html>

Anonymous

2025-12-19T09:58:19.3933333+00:00

Hi @Joseph Kashishian , do you have any update on responses below? If you find any answer useful to you, please kindly mark it as final answer! Thanks

Answer accepted by question author

SurferOnWww 6,106

Please try the followings:

(1) Add form tag to .cshtml.

(2) Create the FormData object form the form tag.

(3) Send the FormData using jQuery ajax or fetch API.

Shown below are the samples:

Model

namespace RazorPages.Models
{
    public class PersonModel
    {
        public string Name { get; set; } = string.Empty;
        public string DateTime { get; set; } = string.Empty;
    }
}

.cshtml.cs

using Microsoft.AspNetCore.Mvc;
using Microsoft.AspNetCore.Mvc.RazorPages;
using RazorPages.Models;

namespace RazorPages.Pages
{
    public class AjaxPostModel : PageModel
    {
        public void OnGet()
        {
        }

        [BindProperty]
        public PersonModel Model { get; set; } = default!;

        public IActionResult OnPost()
        {
            if (Request.Headers.XRequestedWith == "XMLHttpRequest")
            {
                string name = Model.Name;
                string dateTime = Model.DateTime;
                return Content($"Name: {name}, DateTime: {dateTime}");
            }
            else
            {
                return BadRequest();
            }
        }
    }
}

.cshtml

@page

@model RazorPages.Pages.AjaxPostModel
@{
    ViewData["Title"] = "AjaxPost";
}

<h1>AjaxPost</h1>

<hr />

<form method="post">
    <input type="text" name="name" />
    <br />
    <input type="text" name="datetime" />
    <br />
</form>

<input type="button" id="ajaxPost" value="POST" />

<div id="result"></div>

@section Scripts {
    <script type="text/javascript">
        //<![CDATA[
        document.getElementById("ajaxPost")
            .addEventListener('click', async () => {
                const fd = new FormData(document.querySelector("form"));
                const result = document.getElementById("result");                

                const param = {
                    method: "POST",
                    body: fd,
                    // set X-Requested-With in request header
                    headers: { 'X-Requested-With': 'XMLHttpRequest' }
                }

                const response = await fetch("/ajaxpost", param);

                if (response.ok) {
                    const data = await response.text();
                    result.innerText = data;
                } else {
                    result.innerText = "response.ok is false";
                }
            });
        //]]>
    </script>
}

CSRF token in cookie sent to the server:

enter image description here

CSRF token in hidden field sent to the server:

enter image description here

Result

enter image description here

To see if the validation of CSRF-token is working, delete cookie of browser after the browser has received the response of OnGet() method and send the FormData by clicking the [POST] button. The ASP.NET will return 400 Bad request without invoking the OnPost() method.

0 comments

6 additional answers

Joseph Kashishian 65

the issue is with my startup and Program file. I have some conflicts with the run commands.

I was able to get it to run if I take out the webBuilder.UseStartup<Startup>(); and put everything in program file but unfortunately, I have a lot of important things going on. There is an issue with I have the app.run and the CreateHostBuilder(args).Build().Run(); and still trying how to separate. Attached is the code in my startup and program.

Anonymous

2026-01-05T08:20:17.6833333+00:00

Hello Joseph Kashishian,

I’ve read your latest response, but I don’t see any attachment included. Would you mind double‑checking and uploading it again?

Thank you very much.

Joseph Kashishian 65

Any help with this would be great. There are some things in the current configuration I'm trying to work thru and convert some things. I put headers in tags so you can see where things start and end.

There are two files in here; This does not work and trying to figure out how to modify stuff in the startup to work with token.

I included code that does work in the very last section below. I believe there are some conflicts in the startup how I build my app object and having hard time figuring it out.

In the Startup I have other configurations and things I need to keep and trying how to modify that code to work with the token.

Below is the code that does not work.

is the Program.CS
is the Startup.CS
Sample code that works in my project but I need other things in the Startup.CS and don't' know yet how to convert them to align with working with the Token.
Program.CS

///// Beginning of Program.CS

using Microsoft.AspNetCore.Builder;

using Microsoft.AspNetCore.Hosting;

using Microsoft.Extensions.DependencyInjection;

using Microsoft.Extensions.Hosting;

using System.IO;

using Newtonsoft.Json.Serialization;

namespace House

{

public class Program

{

    public static void Main(string[] args)

    {

        CreateHostBuilder(args).Build().Run();

    }

    public static IHostBuilder CreateHostBuilder(string[] args) =>

        Host.CreateDefaultBuilder(args)

            .ConfigureWebHostDefaults(webBuilder =>

            {

                

                //webBuilder.UseKestrel();

                webBuilder.UseContentRoot(Directory.GetCurrentDirectory());

                webBuilder.UseIISIntegration();

                var builder = WebApplication.CreateBuilder(args);

                builder.Services.AddRazorPages()

                    .AddJsonOptions(options => options.JsonSerializerOptions.PropertyNamingPolicy = null);

                builder.Services.AddAntiforgery(o => o.HeaderName = "XSRF-TOKEN");

                var app = builder.Build();

                app.MapRazorPages();

                webBuilder.UseStartup<Startup>();

     

            });

}

}

///// End of Program.CS

Startup.CS

///// Beginning of Startup.CS

using Microsoft.AspNetCore.Authentication.Cookies;

using Microsoft.AspNetCore.Builder;

using Microsoft.AspNetCore.Hosting;

using Microsoft.AspNetCore.Http;

using Microsoft.AspNetCore.Mvc;

using Microsoft.Extensions.Caching.Memory;

using Microsoft.Extensions.Configuration;

using Microsoft.Extensions.DependencyInjection;

using Microsoft.Extensions.Hosting;

using Newtonsoft.Json.Serialization;

using House.Credentials;

using House.Handlers;

using House.Models;

using House.Models.Interfaces;

using House.Models.Lists;

using System;

using System.Security.Claims;using System.Collections.Generic;

using System.Linq;

using System.Threading.Tasks;

using Microsoft.AspNetCore.Antiforgery;

namespace House

{

public class Startup

{

    

    private IMemoryCache Cache;

    public static string ConnectionString { get; set; }

    // public Startup(IConfiguration configuration, IWebHostEnvironment env)

    public Startup(IWebHostEnvironment env)

    {

        var builder = new ConfigurationBuilder()

        .SetBasePath(env.ContentRootPath)

        .AddJsonFile("appsettings.json", optional: false, reloadOnChange: true)

        .AddJsonFile($"appsettings.{env.EnvironmentName}.json", optional: true)

        .AddEnvironmentVariables();

        Configuration = builder.Build();

        ConnectionString = ConfigurationExtensions.GetConnectionString(Configuration, "DefaultConnection");

    }

    public IConfiguration Configuration { get; }

    // This method gets called by the runtime. Use this method to add services to the container.

    

    

    

    public void ConfigureServices(IServiceCollection services)

    {

         services.Configure<CookiePolicyOptions>(options =>

        {

            options.CheckConsentNeeded = context => true;

            options.MinimumSameSitePolicy = SameSiteMode.None;

        });

        //AUTHORIZATION POLICIES

        services.AddAuthorization(options =>

        {

            options.AddPolicy("Administrators", policy => policy.RequireClaim(ClaimTypes.Role, "Admin"));

            options.AddPolicy("Readers", policy => policy.RequireClaim(ClaimTypes.Role, "Reader"));

            options.AddPolicy("Users", policy => policy.RequireClaim(ClaimTypes.Role, "User"));

            options.AddPolicy("Managers", policy => policy.RequireClaim(ClaimTypes.Role, "Manager"));

            // NOTE: Database contains these roles, if new roles are added to database

            //       THEN add a corresponding entry here.

            //       Note: Roles DO NOT need to be added to policy if not used for policy related activities.

        });

        services.ConfigureApplicationCookie(options => options.LoginPath = "/");

        services.AddAuthentication(CookieAuthenticationDefaults.AuthenticationScheme).AddCookie(cookieOptions =>

        {

            cookieOptions.LoginPath = "/";

        });

        //services.AddDistributedMemoryCache();

        services.AddMemoryCache();

        services.AddSession(options =>

        {

            options.IdleTimeout = TimeSpan.FromMinutes(1);

            // You can set Time

            // Time out is reset on each request if and only if the time-out

            // has not been reached. This is a sliding time span.

        });

        //IIS configuration

        services.Configure<IISServerOptions>(options =>

        {

            options.AutomaticAuthentication = true;

        });

        services.Configure<Credentials.LdapConfig>(Configuration.GetSection("Ldap"));

        services.AddScoped<IAuthenticationService, LdapAuthenticationService>();

        services.AddRazorPages();

        // This section (AddRazorPagesOptions) sets authorizations for folder and pages 

        // based on policies listed above.

        // Values here are based on roles from the database, so if you enter a new

        // option for "Authorize Page" or "Authorize Folder" the roles for these

        // options must be in the database and added to the "Authorization Policy" section above to work.

        services.AddMvc().AddRazorPagesOptions(options =>

        {

            options.Conventions.AuthorizeFolder("/Admin", "Administrators");

            options.Conventions.AuthorizePage("/Agencies/Add", "Administrators");

        }).SetCompatibilityVersion(CompatibilityVersion.Version_3_0);

        services.AddTransient(typeof(IUser), typeof(Credentials.User));

        services.AddTransient(typeof(IUser), typeof(User));

        services.AddScoped(typeof(IClient), typeof(Client));

        services.AddScoped(typeof(IClientSearch), typeof(ClientSearch));

        services.AddScoped(typeof(IUserTrackingItem), typeof(UserTrackingItem));

        services.AddScoped(typeof(IApplicationExceptionItem), typeof(ApplicationExceptionItem));

    }

    // Request Pipeline Configuration:  This method gets called by the runtime. Use this method to configure the HTTP request pipeline.

    public void Configure(IApplicationBuilder app, IWebHostEnvironment env, IMemoryCache cache)

    {

        this.Cache = cache;

        var CacheEntryOptions = new MemoryCacheEntryOptions().SetPriority(CacheItemPriority.NeverRemove);

        CacheEntryOptions.RegisterPostEvictionCallback(callback: LookupListCacheEvictionCallback, state: this);

        if (!env.IsDevelopment())

        {

            // The default HSTS value is 30 days. You may want to change this for production scenarios, see https://aka.ms/aspnetcore-hsts.

            app.UseHsts();

        }

        app.UseMiddleware(typeof(ExceptionMiddleware));

       

        app.UseHttpsRedirection();

        app.UseStaticFiles();

        app.UseSession();

        app.UseRouting();

       

        // Tell the pipeline we want to use both authentication and authorization

        app.UseAuthentication();

        app.UseAuthorization();

        //Make pipeline map razor pages to routes and MVC framework.

        app.UseEndpoints(endpoints =>

                    {

                        endpoints.MapRazorPages();

                    });

    }

    /// <summary>

    /// Delegate Callback for IMemoryCache.CacheEntryOptions.RegisterPostEvictionCallback

    /// Intended to reload lookup lists if item (object) in the cache was evicted (removed)

    /// </summary>

    /// <param name="key"></param>

    /// <param name="value"></param>

    /// <param name="reason"></param>

    /// <param name="state"></param>

    private void LookupListCacheEvictionCallback(object key, object value, EvictionReason reason, object state)

    {

        // Method Notes:

        // Cache entry options apply to each cache entry and only cache entries

        // which specifically register this callback will get reloaded if

        // the cache entry was removed.  Do not use this callback for anything

        // other than ILookupList as it will fail.  

        // If a cache entry is NOT an ILookupList instance then register a different

        // callback handler for it instead of using this.

        // To clarify, IMemoryCache may contain different types of objects in the Cache

        // therefore this callback is explicit for the type of ILookupList only.

        // If a different callback handler is needed for a different type

        // don't forget to add a handler method in the Handlers.CacheHandler class.

        // A handler method is NOT required but recommended as all work can actually

        // be completed in the callback method.  In this callback method

        // we are simply using Handlers.CacheHandler to get a new dictionary of 

        // values to set a new Cache entry with.

        // To simplify, you may use a different delegate for each and every

        // Cache entry if needed.

        CacheHandler handler = new CacheHandler(this.Configuration);

        var CacheEntryOptions = new MemoryCacheEntryOptions().SetPriority(CacheItemPriority.NeverRemove);

        CacheEntryOptions.RegisterPostEvictionCallback(callback: LookupListCacheEvictionCallback, state: this);

        this.Cache.Set($"{key}", handler.SetLookupLists($"{key}"), CacheEntryOptions);

    }

}

}

NOTES:

we can also use Options.AbsoluteExpirationRelativeToNow = time (TimeSpan time = new TimeSpan(0, 0, 30);); to set cache expiration evictions.

//// End of Startup.CS

Code that works but does not have other configurations I need.

A) Program.CS

using System;

using System.Collections.Generic;

using System.Linq;

using System.Threading.Tasks;

using Microsoft.AspNetCore.Builder;

using Microsoft.AspNetCore.Hosting;

using Microsoft.AspNetCore.Http;

using Microsoft.AspNetCore.Mvc;

using Microsoft.Extensions.DependencyInjection;

var builder = WebApplication.CreateBuilder(args);

// Add services to the container.

//builder.Services.AddRazorPages();

builder.Services.AddRazorPages()

.AddJsonOptions(options => options.JsonSerializerOptions.PropertyNamingPolicy = null);

builder.Services.AddAntiforgery(o => o.HeaderName = "XSRF-TOKEN");

var app = builder.Build();

// Configure the HTTP request pipeline.

if (!app.Environment.IsDevelopment())

{

app.UseExceptionHandler("/Error");

// The default HSTS value is 30 days. You may want to change this for production scenarios, see https://aka.ms/aspnetcore-hsts.

app.UseHsts();

}

app.UseHttpsRedirection();

app.UseStaticFiles();

app.UseRouting();

app.UseAuthorization();

app.MapRazorPages();

app.Run();

//// End of program that works

Startup.CS I don't ' call this

Joseph Kashishian 65

there are two files in here; This does not work and trying to figure out how to modify stuff in the startup to work with token.

I included code that does work in the very last section below. I believe there are some conflicts in the startup how I build my app object and having hard time figuring it out.

In the Startup I have other configurations and things I need to keep and trying how to modify that code to work with the token.

Below is the code that does not work.

is the Program.CS
is the Startup.CS
Sample code that works in my project but I need other things in the Startup.CS and don't' know yet how to convert them to align with working with the Token.
Program.CS

///// Beginning of Program.CS

using Microsoft.AspNetCore.Builder;

using Microsoft.AspNetCore.Hosting;

using Microsoft.Extensions.DependencyInjection;

using Microsoft.Extensions.Hosting;

using System.IO;

using Newtonsoft.Json.Serialization;

namespace House

{

public class Program

{

    public static void Main(string[] args)

    {

        CreateHostBuilder(args).Build().Run();

    }

    public static IHostBuilder CreateHostBuilder(string[] args) =>

        Host.CreateDefaultBuilder(args)

            .ConfigureWebHostDefaults(webBuilder =>

            {

                

                //webBuilder.UseKestrel();

                webBuilder.UseContentRoot(Directory.GetCurrentDirectory());

                webBuilder.UseIISIntegration();

                var builder = WebApplication.CreateBuilder(args);

                builder.Services.AddRazorPages()

                    .AddJsonOptions(options => options.JsonSerializerOptions.PropertyNamingPolicy = null);

                builder.Services.AddAntiforgery(o => o.HeaderName = "XSRF-TOKEN");

                var app = builder.Build();

                app.MapRazorPages();

                webBuilder.UseStartup<Startup>();

     

            });

}

}

///// End of Program.CS

Startup.CS

///// Beginning of Startup.CS

using Microsoft.AspNetCore.Authentication.Cookies;

using Microsoft.AspNetCore.Builder;

using Microsoft.AspNetCore.Hosting;

using Microsoft.AspNetCore.Http;

using Microsoft.AspNetCore.Mvc;

using Microsoft.Extensions.Caching.Memory;

using Microsoft.Extensions.Configuration;

using Microsoft.Extensions.DependencyInjection;

using Microsoft.Extensions.Hosting;

using Newtonsoft.Json.Serialization;

using House.Credentials;

using House.Handlers;

using House.Models;

using House.Models.Interfaces;

using House.Models.Lists;

using System;

using System.Security.Claims;using System.Collections.Generic;

using System.Linq;

using System.Threading.Tasks;

using Microsoft.AspNetCore.Antiforgery;

namespace House

{

public class Startup

{

    

    private IMemoryCache Cache;

    public static string ConnectionString { get; set; }

    // public Startup(IConfiguration configuration, IWebHostEnvironment env)

    public Startup(IWebHostEnvironment env)

    {

        var builder = new ConfigurationBuilder()

        .SetBasePath(env.ContentRootPath)

        .AddJsonFile("appsettings.json", optional: false, reloadOnChange: true)

        .AddJsonFile($"appsettings.{env.EnvironmentName}.json", optional: true)

        .AddEnvironmentVariables();

        Configuration = builder.Build();

        ConnectionString = ConfigurationExtensions.GetConnectionString(Configuration, "DefaultConnection");

    }

    public IConfiguration Configuration { get; }

    // This method gets called by the runtime. Use this method to add services to the container.

    

    

    

    public void ConfigureServices(IServiceCollection services)

    {

         services.Configure<CookiePolicyOptions>(options =>

        {

            options.CheckConsentNeeded = context => true;

            options.MinimumSameSitePolicy = SameSiteMode.None;

        });

        //AUTHORIZATION POLICIES

        services.AddAuthorization(options =>

        {

            options.AddPolicy("Administrators", policy => policy.RequireClaim(ClaimTypes.Role, "Admin"));

            options.AddPolicy("Readers", policy => policy.RequireClaim(ClaimTypes.Role, "Reader"));

            options.AddPolicy("Users", policy => policy.RequireClaim(ClaimTypes.Role, "User"));

            options.AddPolicy("Managers", policy => policy.RequireClaim(ClaimTypes.Role, "Manager"));

            // NOTE: Database contains these roles, if new roles are added to database

            //       THEN add a corresponding entry here.

            //       Note: Roles DO NOT need to be added to policy if not used for policy related activities.

        });

        services.ConfigureApplicationCookie(options => options.LoginPath = "/");

        services.AddAuthentication(CookieAuthenticationDefaults.AuthenticationScheme).AddCookie(cookieOptions =>

        {

            cookieOptions.LoginPath = "/";

        });

        //services.AddDistributedMemoryCache();

        services.AddMemoryCache();

        services.AddSession(options =>

        {

            options.IdleTimeout = TimeSpan.FromMinutes(1);

            // You can set Time

            // Time out is reset on each request if and only if the time-out

            // has not been reached. This is a sliding time span.

        });

        //IIS configuration

        services.Configure<IISServerOptions>(options =>

        {

            options.AutomaticAuthentication = true;

        });

        services.Configure<Credentials.LdapConfig>(Configuration.GetSection("Ldap"));

        services.AddScoped<IAuthenticationService, LdapAuthenticationService>();

        services.AddRazorPages();

        // This section (AddRazorPagesOptions) sets authorizations for folder and pages 

        // based on policies listed above.

        // Values here are based on roles from the database, so if you enter a new

        // option for "Authorize Page" or "Authorize Folder" the roles for these

        // options must be in the database and added to the "Authorization Policy" section above to work.

        services.AddMvc().AddRazorPagesOptions(options =>

        {

            options.Conventions.AuthorizeFolder("/Admin", "Administrators");

            options.Conventions.AuthorizePage("/Agencies/Add", "Administrators");

        }).SetCompatibilityVersion(CompatibilityVersion.Version_3_0);

        services.AddTransient(typeof(IUser), typeof(Credentials.User));

        services.AddTransient(typeof(IUser), typeof(User));

        services.AddScoped(typeof(IClient), typeof(Client));

        services.AddScoped(typeof(IClientSearch), typeof(ClientSearch));

        services.AddScoped(typeof(IUserTrackingItem), typeof(UserTrackingItem));

        services.AddScoped(typeof(IApplicationExceptionItem), typeof(ApplicationExceptionItem));

    }

    // Request Pipeline Configuration:  This method gets called by the runtime. Use this method to configure the HTTP request pipeline.

    public void Configure(IApplicationBuilder app, IWebHostEnvironment env, IMemoryCache cache)

    {

        this.Cache = cache;

        var CacheEntryOptions = new MemoryCacheEntryOptions().SetPriority(CacheItemPriority.NeverRemove);

        CacheEntryOptions.RegisterPostEvictionCallback(callback: LookupListCacheEvictionCallback, state: this);

        if (!env.IsDevelopment())

        {

            // The default HSTS value is 30 days. You may want to change this for production scenarios, see https://aka.ms/aspnetcore-hsts.

            app.UseHsts();

        }

        app.UseMiddleware(typeof(ExceptionMiddleware));

       

        app.UseHttpsRedirection();

        app.UseStaticFiles();

        app.UseSession();

        app.UseRouting();

       

        // Tell the pipeline we want to use both authentication and authorization

        app.UseAuthentication();

        app.UseAuthorization();

        //Make pipeline map razor pages to routes and MVC framework.

        app.UseEndpoints(endpoints =>

                    {

                        endpoints.MapRazorPages();

                    });

    }

    /// <summary>

    /// Delegate Callback for IMemoryCache.CacheEntryOptions.RegisterPostEvictionCallback

    /// Intended to reload lookup lists if item (object) in the cache was evicted (removed)

    /// </summary>

    /// <param name="key"></param>

    /// <param name="value"></param>

    /// <param name="reason"></param>

    /// <param name="state"></param>

    private void LookupListCacheEvictionCallback(object key, object value, EvictionReason reason, object state)

    {

        // Method Notes:

        // Cache entry options apply to each cache entry and only cache entries

        // which specifically register this callback will get reloaded if

        // the cache entry was removed.  Do not use this callback for anything

        // other than ILookupList as it will fail.  

        // If a cache entry is NOT an ILookupList instance then register a different

        // callback handler for it instead of using this.

        // To clarify, IMemoryCache may contain different types of objects in the Cache

        // therefore this callback is explicit for the type of ILookupList only.

        // If a different callback handler is needed for a different type

        // don't forget to add a handler method in the Handlers.CacheHandler class.

        // A handler method is NOT required but recommended as all work can actually

        // be completed in the callback method.  In this callback method

        // we are simply using Handlers.CacheHandler to get a new dictionary of 

        // values to set a new Cache entry with.

        // To simplify, you may use a different delegate for each and every

        // Cache entry if needed.

        CacheHandler handler = new CacheHandler(this.Configuration);

        var CacheEntryOptions = new MemoryCacheEntryOptions().SetPriority(CacheItemPriority.NeverRemove);

        CacheEntryOptions.RegisterPostEvictionCallback(callback: LookupListCacheEvictionCallback, state: this);

        this.Cache.Set($"{key}", handler.SetLookupLists($"{key}"), CacheEntryOptions);

    }

}

}

NOTES:

we can also use Options.AbsoluteExpirationRelativeToNow = time (TimeSpan time = new TimeSpan(0, 0, 30);); to set cache expiration evictions.

//// End of Startup.CS

Code that works but does not have other configurations I need.

A) Program.CS

using System;

using System.Collections.Generic;

using System.Linq;

using System.Threading.Tasks;

using Microsoft.AspNetCore.Builder;

using Microsoft.AspNetCore.Hosting;

using Microsoft.AspNetCore.Http;

using Microsoft.AspNetCore.Mvc;

using Microsoft.Extensions.DependencyInjection;

var builder = WebApplication.CreateBuilder(args);

// Add services to the container.

//builder.Services.AddRazorPages();

builder.Services.AddRazorPages()

.AddJsonOptions(options => options.JsonSerializerOptions.PropertyNamingPolicy = null);

builder.Services.AddAntiforgery(o => o.HeaderName = "XSRF-TOKEN");

var app = builder.Build();

// Configure the HTTP request pipeline.

if (!app.Environment.IsDevelopment())

{

app.UseExceptionHandler("/Error");

// The default HSTS value is 30 days. You may want to change this for production scenarios, see https://aka.ms/aspnetcore-hsts.

app.UseHsts();

}

app.UseHttpsRedirection();

app.UseStaticFiles();

app.UseRouting();

app.UseAuthorization();

app.MapRazorPages();

app.Run();

//// End of program that works

Startup.CS I don't ' call this

Joseph Kashishian 65

I'm going to look at this this week. The issue has to do with the Version the application is on. It was a Asp.Core 2.1 migrated to .net 7 and there think there are some things in the configuration files stepping on the token toes. I was able to create a new solution and get it working but have not got it to work in my current project. I'm going to go thru some testing and process of elimination in the startup later in the week to see If I can narrow it down to the code causing the issue.

Anonymous

2025-12-16T10:39:05.1433333+00:00

Thanks Joseph Kashishian for the update, i'm looking forward to your reponse!

Joseph Kashishian 65

there are two files in here; This does not work and trying to figure out how to modify stuff in the startup to work with token.

I included code that does work in the very last section below. I believe there are some conflicts in the startup how I build my app object and having hard time figuring it out.

In the Startup I have other configurations and things I need to keep and trying how to modify that code to work with the token.

Below is the code that does not work.

is the Program.CS
is the Startup.CS
Sample code that works in my project but I need other things in the Startup.CS and don't' know yet how to convert them to align with working with the Token.
Program.CS

///// Beginning of Program.CS

using Microsoft.AspNetCore.Builder;

using Microsoft.AspNetCore.Hosting;

using Microsoft.Extensions.DependencyInjection;

using Microsoft.Extensions.Hosting;

using System.IO;

using Newtonsoft.Json.Serialization;

namespace House

{

public class Program

{

    public static void Main(string[] args)

    {

        CreateHostBuilder(args).Build().Run();

    }

    public static IHostBuilder CreateHostBuilder(string[] args) =>

        Host.CreateDefaultBuilder(args)

            .ConfigureWebHostDefaults(webBuilder =>

            {

                

                //webBuilder.UseKestrel();

                webBuilder.UseContentRoot(Directory.GetCurrentDirectory());

                webBuilder.UseIISIntegration();

                var builder = WebApplication.CreateBuilder(args);

                builder.Services.AddRazorPages()

                    .AddJsonOptions(options => options.JsonSerializerOptions.PropertyNamingPolicy = null);

                builder.Services.AddAntiforgery(o => o.HeaderName = "XSRF-TOKEN");

                var app = builder.Build();

                app.MapRazorPages();

                webBuilder.UseStartup<Startup>();

     

            });

}

}

///// End of Program.CS

Startup.CS

///// Beginning of Startup.CS

using Microsoft.AspNetCore.Authentication.Cookies;

using Microsoft.AspNetCore.Builder;

using Microsoft.AspNetCore.Hosting;

using Microsoft.AspNetCore.Http;

using Microsoft.AspNetCore.Mvc;

using Microsoft.Extensions.Caching.Memory;

using Microsoft.Extensions.Configuration;

using Microsoft.Extensions.DependencyInjection;

using Microsoft.Extensions.Hosting;

using Newtonsoft.Json.Serialization;

using House.Credentials;

using House.Handlers;

using House.Models;

using House.Models.Interfaces;

using House.Models.Lists;

using System;

using System.Security.Claims;using System.Collections.Generic;

using System.Linq;

using System.Threading.Tasks;

using Microsoft.AspNetCore.Antiforgery;

namespace House

{

public class Startup

{

    

    private IMemoryCache Cache;

    public static string ConnectionString { get; set; }

    // public Startup(IConfiguration configuration, IWebHostEnvironment env)

    public Startup(IWebHostEnvironment env)

    {

        var builder = new ConfigurationBuilder()

        .SetBasePath(env.ContentRootPath)

        .AddJsonFile("appsettings.json", optional: false, reloadOnChange: true)

        .AddJsonFile($"appsettings.{env.EnvironmentName}.json", optional: true)

        .AddEnvironmentVariables();

        Configuration = builder.Build();

        ConnectionString = ConfigurationExtensions.GetConnectionString(Configuration, "DefaultConnection");

    }

    public IConfiguration Configuration { get; }

    // This method gets called by the runtime. Use this method to add services to the container.

    

    

    

    public void ConfigureServices(IServiceCollection services)

    {

         services.Configure<CookiePolicyOptions>(options =>

        {

            options.CheckConsentNeeded = context => true;

            options.MinimumSameSitePolicy = SameSiteMode.None;

        });

        //AUTHORIZATION POLICIES

        services.AddAuthorization(options =>

        {

            options.AddPolicy("Administrators", policy => policy.RequireClaim(ClaimTypes.Role, "Admin"));

            options.AddPolicy("Readers", policy => policy.RequireClaim(ClaimTypes.Role, "Reader"));

            options.AddPolicy("Users", policy => policy.RequireClaim(ClaimTypes.Role, "User"));

            options.AddPolicy("Managers", policy => policy.RequireClaim(ClaimTypes.Role, "Manager"));

            // NOTE: Database contains these roles, if new roles are added to database

            //       THEN add a corresponding entry here.

            //       Note: Roles DO NOT need to be added to policy if not used for policy related activities.

        });

        services.ConfigureApplicationCookie(options => options.LoginPath = "/");

        services.AddAuthentication(CookieAuthenticationDefaults.AuthenticationScheme).AddCookie(cookieOptions =>

        {

            cookieOptions.LoginPath = "/";

        });

        //services.AddDistributedMemoryCache();

        services.AddMemoryCache();

        services.AddSession(options =>

        {

            options.IdleTimeout = TimeSpan.FromMinutes(1);

            // You can set Time

            // Time out is reset on each request if and only if the time-out

            // has not been reached. This is a sliding time span.

        });

        //IIS configuration

        services.Configure<IISServerOptions>(options =>

        {

            options.AutomaticAuthentication = true;

        });

        services.Configure<Credentials.LdapConfig>(Configuration.GetSection("Ldap"));

        services.AddScoped<IAuthenticationService, LdapAuthenticationService>();

        services.AddRazorPages();

        // This section (AddRazorPagesOptions) sets authorizations for folder and pages 

        // based on policies listed above.

        // Values here are based on roles from the database, so if you enter a new

        // option for "Authorize Page" or "Authorize Folder" the roles for these

        // options must be in the database and added to the "Authorization Policy" section above to work.

        services.AddMvc().AddRazorPagesOptions(options =>

        {

            options.Conventions.AuthorizeFolder("/Admin", "Administrators");

            options.Conventions.AuthorizePage("/Agencies/Add", "Administrators");

        }).SetCompatibilityVersion(CompatibilityVersion.Version_3_0);

        services.AddTransient(typeof(IUser), typeof(Credentials.User));

        services.AddTransient(typeof(IUser), typeof(User));

        services.AddScoped(typeof(IClient), typeof(Client));

        services.AddScoped(typeof(IClientSearch), typeof(ClientSearch));

        services.AddScoped(typeof(IUserTrackingItem), typeof(UserTrackingItem));

        services.AddScoped(typeof(IApplicationExceptionItem), typeof(ApplicationExceptionItem));

    }

    // Request Pipeline Configuration:  This method gets called by the runtime. Use this method to configure the HTTP request pipeline.

    public void Configure(IApplicationBuilder app, IWebHostEnvironment env, IMemoryCache cache)

    {

        this.Cache = cache;

        var CacheEntryOptions = new MemoryCacheEntryOptions().SetPriority(CacheItemPriority.NeverRemove);

        CacheEntryOptions.RegisterPostEvictionCallback(callback: LookupListCacheEvictionCallback, state: this);

        if (!env.IsDevelopment())

        {

            // The default HSTS value is 30 days. You may want to change this for production scenarios, see https://aka.ms/aspnetcore-hsts.

            app.UseHsts();

        }

        app.UseMiddleware(typeof(ExceptionMiddleware));

       

        app.UseHttpsRedirection();

        app.UseStaticFiles();

        app.UseSession();

        app.UseRouting();

       

        // Tell the pipeline we want to use both authentication and authorization

        app.UseAuthentication();

        app.UseAuthorization();

        //Make pipeline map razor pages to routes and MVC framework.

        app.UseEndpoints(endpoints =>

                    {

                        endpoints.MapRazorPages();

                    });

    }

    /// <summary>

    /// Delegate Callback for IMemoryCache.CacheEntryOptions.RegisterPostEvictionCallback

    /// Intended to reload lookup lists if item (object) in the cache was evicted (removed)

    /// </summary>

    /// <param name="key"></param>

    /// <param name="value"></param>

    /// <param name="reason"></param>

    /// <param name="state"></param>

    private void LookupListCacheEvictionCallback(object key, object value, EvictionReason reason, object state)

    {

        // Method Notes:

        // Cache entry options apply to each cache entry and only cache entries

        // which specifically register this callback will get reloaded if

        // the cache entry was removed.  Do not use this callback for anything

        // other than ILookupList as it will fail.  

        // If a cache entry is NOT an ILookupList instance then register a different

        // callback handler for it instead of using this.

        // To clarify, IMemoryCache may contain different types of objects in the Cache

        // therefore this callback is explicit for the type of ILookupList only.

        // If a different callback handler is needed for a different type

        // don't forget to add a handler method in the Handlers.CacheHandler class.

        // A handler method is NOT required but recommended as all work can actually

        // be completed in the callback method.  In this callback method

        // we are simply using Handlers.CacheHandler to get a new dictionary of 

        // values to set a new Cache entry with.

        // To simplify, you may use a different delegate for each and every

        // Cache entry if needed.

        CacheHandler handler = new CacheHandler(this.Configuration);

        var CacheEntryOptions = new MemoryCacheEntryOptions().SetPriority(CacheItemPriority.NeverRemove);

        CacheEntryOptions.RegisterPostEvictionCallback(callback: LookupListCacheEvictionCallback, state: this);

        this.Cache.Set($"{key}", handler.SetLookupLists($"{key}"), CacheEntryOptions);

    }

}

}

NOTES:

we can also use Options.AbsoluteExpirationRelativeToNow = time (TimeSpan time = new TimeSpan(0, 0, 30);); to set cache expiration evictions.

//// End of Startup.CS

Code that works but does not have other configurations I need.

A) Program.CS

using System;

using System.Collections.Generic;

using System.Linq;

using System.Threading.Tasks;

using Microsoft.AspNetCore.Builder;

using Microsoft.AspNetCore.Hosting;

using Microsoft.AspNetCore.Http;

using Microsoft.AspNetCore.Mvc;

using Microsoft.Extensions.DependencyInjection;

var builder = WebApplication.CreateBuilder(args);

// Add services to the container.

//builder.Services.AddRazorPages();

builder.Services.AddRazorPages()

.AddJsonOptions(options => options.JsonSerializerOptions.PropertyNamingPolicy = null);

builder.Services.AddAntiforgery(o => o.HeaderName = "XSRF-TOKEN");

var app = builder.Build();

// Configure the HTTP request pipeline.

if (!app.Environment.IsDevelopment())

{

app.UseExceptionHandler("/Error");

// The default HSTS value is 30 days. You may want to change this for production scenarios, see https://aka.ms/aspnetcore-hsts.

app.UseHsts();

}

app.UseHttpsRedirection();

app.UseStaticFiles();

app.UseRouting();

app.UseAuthorization();

app.MapRazorPages();

app.Run();

//// End of program that works

Startup.CS I don't ' call this

Ajax post with C# Handler and XSRF-TOKEN

6 additional answers

Your answer