how to include AntiForgeryToken in an ajax action link in mvc?

3
votes

I have the following code:

@Ajax.ActionLink("Delete", "Delete", 
new { id = item.ID, RequestVerificationToken=*What comes here?*}, 
new AjaxOptions { HttpMethod = "POST", UpdateTargetId = "formsIndex" })

I want to add the verification token to the link without using javascript in client side, it seems like a redundant dependancy since i already own that value in server. Is there a proper way to do that?

1
ajaxasp.net-mvcsecurityrazorcsrf
Create a form (Ajax.BeginForm()) and include @Html.AntiForgeryToken() - user3559349

1 Answers

6
votes

From the MSDN documentation (my emphasis)

HtmlHelper.AntiForgeryToken Method

Generates a hidden form field (anti-forgery token) that is validated when the form is submitted.

You need a form element to generate the anti-forgery token.

@Ajax.BeginForm("Delete", new { id = item.ID }, new AjaxOptions { UpdateTargetId = "formsIndex" }))
{
  @Html.AntiForgeryToken()
  <input type="submit" value="Delete" /> // style to look like a link if that's what you want
}