How to call API with AntiForgeryToken using Postman in IdentityServer ASP.NET Core

Question

I'm trying to test my API with Identity Server Asp.net Core using Postman.

This is the way that I'm trying to do:

First request HttpGet to https://localhost:5000/Account/Login and in response body I received: <input name="__RequestVerificationToken" type="hidden" value="CfDJ8MoS9upoM4dNp8Kx-AdvA-uYr13_PAkuMZpzYMV8UmxZq5GdLTvN-Ht5NpTLmPtlhL5d5z2Hu2vUJoJGhk1AMlARDcOwqgq7Cef1dfQL_vl4tIFM4kx9RZPz8DHU26-U9qLnKAIstZgR42-1FuGNh24" />

And in Cookie (not sure for what it is though):

Then HttpPost to https://localhost:5000/Account/Login with RequestVerificationToken with token received from body HttpGet request.

And always error 400 as you can see at screen shot above.

In Visual studio I can see that some request was catched but clearly was incorrect.

If I'll remove attribute [ValidateAntiForgeryToken] then of course everything works fine but obviously because that validation is disabled.

The input field name is __RequestVerificationToken. Note the double underscore at the start. — Brad
Right, I was trying before with __ and the same problem occurs. — DiPix
Are you including it in the body? It's a form field, not a header. — Brad
He needs it to get a Bearer Token and to be able to add these Bearer tokens to his API requests, so that he can Test Methods that have the [Authorize] Attribute on them. I have the same problem. — axelrotter

Burhan Savci Burhan Savci · Accepted Answer · 2021-01-11T11:56:06

You'd need to do followings to send such a request:

1.) Enter __RequestVerificationToken key value (don't forget double underscores) into x-www-form-urlencoded

2.) You need to add .AspNetCore.Antiforgery cookie to the Cookies section in Postman.

For example like this .AspNetCore.Antiforgery.1XHiLFgQI2w=your cookie value; Path=/; Domain=localhost;Expires=Session;

You can find .AspNetCore.Antiforgery cookie in Application section in Google Developer Tools