RequestVerificationToken in query string

Question

I have an issue with ajax posts I'm doing for a form that contains @Html.AntiForgeryToken().

When I post the form via ajax I get the following query string: http://myhost.local/Assessment/NextQuestion/15?__RequestVerificationToken=HVHkyjrwWupa9pU6tiMVjSDept5XeBtCyNL0tHwWEkfFDHJLXps9oRG7AlfvVHOx0tK0pE78KaQMD7gL5YBBXu_TfKhC3Pd69WaGCldFhPQhbP2t0

How do I remove this from the query string? The query string doesn't contain this when doing a standard post.

Form:

@using (Html.BeginForm("NextQuestion", "Assessment", FormMethod.Post, new { @class = "form-vertical"}))
    {

        @Html.AntiForgeryToken()
        ....
    }

Post function:

$('form.ajaxForm').on('submit', (function() {
        $("#loadingIndicator").show();
        $.ajax(
            {
                type: "POST",
                url: $('form.ajaxForm').attr("action"),
                data: $('form.ajaxForm').serialize(),
                success:
                    function(result) {
                        $("#loadingIndicator").hide();
                        if (result.redirect) {
                            window.location.href = result.redirect;
                            return;
                        } else {
                            alert(result.ValidationMessage());
                        }
                    },
                error:
                    function(req, status, err) {
                        alert('error');
                        $("#loadingIndicator").hide();
                    },
            });
        return false;
    }));

Action Method:

 [HttpPost]
 [ValidateAntiForgeryToken]
 public JsonResult NextQuestion(AssessmentModel model)

hitch · Accepted Answer · 2013-10-08 04:22:28Z

2

This is being added to the query string as it is a mandatory requirement when using

[ValidateAntiForgeryToken]

and

@Html.AntiForgeryToken()

The AntiForgeryToken must be returned to the server so that it can be validated appropriately, and because you are doing

data: $('form.ajaxForm').serialize(),

and the AntiForgeryToken is in your form, it is serialized appropriately.

Therefore it is a necessary requirement if you are to use the [ValidateAntiForgeryToken].

If i've missed something, and all you want to do is to remove it from the query string for some other reason, then you would need to somehow string process the output of your call to

$('form.ajaxForm').serialize()

I'd suggest using a regular expression of some sort to search for __RequestVerificationToken and either end of string, or until the next &/start of next querystring key value pair.

answered Oct 8, 2013 at 4:22

hitch

9201 gold badge11 silver badges27 bronze badges

Sign up to request clarification or add additional context in comments.

1 Comment

hitch Over a year ago

Ok - my mistake - not sure why, but I'd assumed you were doing a Get, as discussed here... stackoverflow.com/questions/8473917/…

Collectives™ on Stack Overflow

RequestVerificationToken in query string

1 Answer 1

1 Comment

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

1 Comment

Your Answer

Sign up or log in

Post as a guest

Linked

Related