Ajax post with C# Handler and XSRF-TOKEN

Hello Joseph Kashishian,

I’ve read your latest response, but I don’t see any attachment included. Would you mind double‑checking and uploading it again?

Thank you very much.

Any help with this would be great. There are some things in the current configuration I'm trying to work thru and convert some things. I put headers in tags so you can see where things start and end.

There are two files in here; This does not work and trying to figure out how to modify stuff in the startup to work with token.

I included code that does work in the very last section below. I believe there are some conflicts in the startup how I build my app object and having hard time figuring it out.

In the Startup I have other configurations and things I need to keep and trying how to modify that code to work with the token.

Below is the code that does not work.

1. is the Program.CS
2. is the Startup.CS
3. Sample code that works in my project but I need other things in the Startup.CS and don't' know yet how to convert them to align with working with the Token.
4. Program.CS

///// Beginning of Program.CS

using Microsoft.AspNetCore.Builder;

using Microsoft.AspNetCore.Hosting;

using Microsoft.Extensions.DependencyInjection;

using Microsoft.Extensions.Hosting;

using System.IO;

using Newtonsoft.Json.Serialization;

namespace House

{

public class Program

{

    public static void Main(string[] args)

    {

        CreateHostBuilder(args).Build().Run();

    }

    public static IHostBuilder CreateHostBuilder(string[] args) =>

        Host.CreateDefaultBuilder(args)

            .ConfigureWebHostDefaults(webBuilder =>

            {

                

                //webBuilder.UseKestrel();

                webBuilder.UseContentRoot(Directory.GetCurrentDirectory());

                webBuilder.UseIISIntegration();

                var builder = WebApplication.CreateBuilder(args);

                builder.Services.AddRazorPages()

                    .AddJsonOptions(options => options.JsonSerializerOptions.PropertyNamingPolicy = null);

                builder.Services.AddAntiforgery(o => o.HeaderName = "XSRF-TOKEN");

                var app = builder.Build();

                app.MapRazorPages();

                webBuilder.UseStartup<Startup>();

     

            });

}

}

///// End of Program.CS

2. Startup.CS

///// Beginning of Startup.CS

using Microsoft.AspNetCore.Authentication.Cookies;

using Microsoft.AspNetCore.Builder;

using Microsoft.AspNetCore.Hosting;

using Microsoft.AspNetCore.Http;

using Microsoft.AspNetCore.Mvc;

using Microsoft.Extensions.Caching.Memory;

using Microsoft.Extensions.Configuration;

using Microsoft.Extensions.DependencyInjection;

using Microsoft.Extensions.Hosting;

using Newtonsoft.Json.Serialization;

using House.Credentials;

using House.Handlers;

using House.Models;

using House.Models.Interfaces;

using House.Models.Lists;

using System;

using System.Security.Claims;using System.Collections.Generic;

using System.Linq;

using System.Threading.Tasks;

using Microsoft.AspNetCore.Antiforgery;

namespace House

{

public class Startup

{

    

    private IMemoryCache Cache;

    public static string ConnectionString { get; set; }

    // public Startup(IConfiguration configuration, IWebHostEnvironment env)

    public Startup(IWebHostEnvironment env)

    {

        var builder = new ConfigurationBuilder()

        .SetBasePath(env.ContentRootPath)

        .AddJsonFile("appsettings.json", optional: false, reloadOnChange: true)

        .AddJsonFile($"appsettings.{env.EnvironmentName}.json", optional: true)

        .AddEnvironmentVariables();

        Configuration = builder.Build();

        ConnectionString = ConfigurationExtensions.GetConnectionString(Configuration, "DefaultConnection");

    }

    public IConfiguration Configuration { get; }

    // This method gets called by the runtime. Use this method to add services to the container.

    

    

    

    public void ConfigureServices(IServiceCollection services)

    {

         services.Configure<CookiePolicyOptions>(options =>

        {

            options.CheckConsentNeeded = context => true;

            options.MinimumSameSitePolicy = SameSiteMode.None;

        });

        //AUTHORIZATION POLICIES

        services.AddAuthorization(options =>

        {

            options.AddPolicy("Administrators", policy => policy.RequireClaim(ClaimTypes.Role, "Admin"));

            options.AddPolicy("Readers", policy => policy.RequireClaim(ClaimTypes.Role, "Reader"));

            options.AddPolicy("Users", policy => policy.RequireClaim(ClaimTypes.Role, "User"));

            options.AddPolicy("Managers", policy => policy.RequireClaim(ClaimTypes.Role, "Manager"));

            // NOTE: Database contains these roles, if new roles are added to database

            //       THEN add a corresponding entry here.

            //       Note: Roles DO NOT need to be added to policy if not used for policy related activities.

        });

        services.ConfigureApplicationCookie(options => options.LoginPath = "/");

        services.AddAuthentication(CookieAuthenticationDefaults.AuthenticationScheme).AddCookie(cookieOptions =>

        {

            cookieOptions.LoginPath = "/";

        });

        //services.AddDistributedMemoryCache();

        services.AddMemoryCache();

        services.AddSession(options =>

        {

            options.IdleTimeout = TimeSpan.FromMinutes(1);

            // You can set Time

            // Time out is reset on each request if and only if the time-out

            // has not been reached. This is a sliding time span.

        });

        //IIS configuration

        services.Configure<IISServerOptions>(options =>

        {

            options.AutomaticAuthentication = true;

        });

        services.Configure<Credentials.LdapConfig>(Configuration.GetSection("Ldap"));

        services.AddScoped<IAuthenticationService, LdapAuthenticationService>();

        services.AddRazorPages();

        // This section (AddRazorPagesOptions) sets authorizations for folder and pages 

        // based on policies listed above.

        // Values here are based on roles from the database, so if you enter a new

        // option for "Authorize Page" or "Authorize Folder" the roles for these

        // options must be in the database and added to the "Authorization Policy" section above to work.

        services.AddMvc().AddRazorPagesOptions(options =>

        {

            options.Conventions.AuthorizeFolder("/Admin", "Administrators");

            options.Conventions.AuthorizePage("/Agencies/Add", "Administrators");

        }).SetCompatibilityVersion(CompatibilityVersion.Version_3_0);

        services.AddTransient(typeof(IUser), typeof(Credentials.User));

        services.AddTransient(typeof(IUser), typeof(User));

        services.AddScoped(typeof(IClient), typeof(Client));

        services.AddScoped(typeof(IClientSearch), typeof(ClientSearch));

        services.AddScoped(typeof(IUserTrackingItem), typeof(UserTrackingItem));

        services.AddScoped(typeof(IApplicationExceptionItem), typeof(ApplicationExceptionItem));

    }

    // Request Pipeline Configuration:  This method gets called by the runtime. Use this method to configure the HTTP request pipeline.

    public void Configure(IApplicationBuilder app, IWebHostEnvironment env, IMemoryCache cache)

    {

        this.Cache = cache;

        var CacheEntryOptions = new MemoryCacheEntryOptions().SetPriority(CacheItemPriority.NeverRemove);

        CacheEntryOptions.RegisterPostEvictionCallback(callback: LookupListCacheEvictionCallback, state: this);

        if (!env.IsDevelopment())

        {

            // The default HSTS value is 30 days. You may want to change this for production scenarios, see https://aka.ms/aspnetcore-hsts.

            app.UseHsts();

        }

        app.UseMiddleware(typeof(ExceptionMiddleware));

       

        app.UseHttpsRedirection();

        app.UseStaticFiles();

        app.UseSession();

        app.UseRouting();

       

        // Tell the pipeline we want to use both authentication and authorization

        app.UseAuthentication();

        app.UseAuthorization();

        //Make pipeline map razor pages to routes and MVC framework.

        app.UseEndpoints(endpoints =>

                    {

                        endpoints.MapRazorPages();

                    });

    }

    /// <summary>

    /// Delegate Callback for IMemoryCache.CacheEntryOptions.RegisterPostEvictionCallback

    /// Intended to reload lookup lists if item (object) in the cache was evicted (removed)

    /// </summary>

    /// <param name="key"></param>

    /// <param name="value"></param>

    /// <param name="reason"></param>

    /// <param name="state"></param>

    private void LookupListCacheEvictionCallback(object key, object value, EvictionReason reason, object state)

    {

        // Method Notes:

        // Cache entry options apply to each cache entry and only cache entries

        // which specifically register this callback will get reloaded if

        // the cache entry was removed.  Do not use this callback for anything

        // other than ILookupList as it will fail.  

        // If a cache entry is NOT an ILookupList instance then register a different

        // callback handler for it instead of using this.

        // To clarify, IMemoryCache may contain different types of objects in the Cache

        // therefore this callback is explicit for the type of ILookupList only.

        // If a different callback handler is needed for a different type

        // don't forget to add a handler method in the Handlers.CacheHandler class.

        // A handler method is NOT required but recommended as all work can actually

        // be completed in the callback method.  In this callback method

        // we are simply using Handlers.CacheHandler to get a new dictionary of 

        // values to set a new Cache entry with.

        // To simplify, you may use a different delegate for each and every

        // Cache entry if needed.

        CacheHandler handler = new CacheHandler(this.Configuration);

        var CacheEntryOptions = new MemoryCacheEntryOptions().SetPriority(CacheItemPriority.NeverRemove);

        CacheEntryOptions.RegisterPostEvictionCallback(callback: LookupListCacheEvictionCallback, state: this);

        this.Cache.Set($"{key}", handler.SetLookupLists($"{key}"), CacheEntryOptions);

    }

}

}

/*

NOTES:

we can also use Options.AbsoluteExpirationRelativeToNow = time (TimeSpan time = new TimeSpan(0, 0, 30);); to set cache expiration evictions.

*/

//// End of Startup.CS

3. Code that works but does not have other configurations I need.

A) Program.CS

using System;

using System.Collections.Generic;

using System.Linq;

using System.Threading.Tasks;

using Microsoft.AspNetCore.Builder;

using Microsoft.AspNetCore.Hosting;

using Microsoft.AspNetCore.Http;

using Microsoft.AspNetCore.Mvc;

using Microsoft.Extensions.DependencyInjection;

var builder = WebApplication.CreateBuilder(args);

// Add services to the container.

//builder.Services.AddRazorPages();

builder.Services.AddRazorPages()

.AddJsonOptions(options => options.JsonSerializerOptions.PropertyNamingPolicy = null);

builder.Services.AddAntiforgery(o => o.HeaderName = "XSRF-TOKEN");

var app = builder.Build();

// Configure the HTTP request pipeline.

if (!app.Environment.IsDevelopment())

{

app.UseExceptionHandler("/Error");

// The default HSTS value is 30 days. You may want to change this for production scenarios, see https://aka.ms/aspnetcore-hsts.

app.UseHsts();

}

app.UseHttpsRedirection();

app.UseStaticFiles();

app.UseRouting();

app.UseAuthorization();

app.MapRazorPages();

app.Run();

//// End of program that works

2. Startup.CS I don't ' call this