asp.net-mvc AntiForgeryToken 在 ASP.Net MVC 4 RC 中已弃用
声明：本页面是StackOverFlow热门问题的中英对照翻译，遵循CC BY-SA 4.0协议，如果您需要使用它，必须同样遵循CC BY-SA许可，注明原文地址和作者信息，同时你必须将它归于原作者（不是我）：StackOverFlow
原文地址: http://stackoverflow.com/questions/10851283/
Warning: these are provided under cc-by-sa 4.0 license. You are free to use/share it, But you must attribute it to the original authors (not me):
StackOverFlow
AntiForgeryToken deprecated in ASP.Net MVC 4 RC
提问by Tom Schreck
I just installed ASP.Net MVC 4 RC to replace ASP.Net MVC 4 beta. When trying to run an existing application I'm getting an error message that AntiForgeryTokenhas been deprecated. Here's my code:
我刚刚安装了 ASP.Net MVC 4 RC 来替换 ASP.Net MVC 4 beta。尝试运行现有应用程序时，我收到一条AntiForgeryToken已弃用的错误消息。这是我的代码：
using (Html.BeginForm("", "", FormMethod.Post, new { id = "MonthElectionForm" }))
{
@Html.AntiForgeryToken("AddEditMonthElection")
}
---- UPDATE ---
- - 更新 - -
ASP.Net MVC 4 RC has made the Salt property obsolete for ValidateAntiForgeryToken attribute and AntiForgeryToken html helper. So, now my code looks like this:
ASP.Net MVC 4 RC 已使 ValidateAntiForgeryToken 属性和 AntiForgeryToken html helper 的 Salt 属性过时。所以，现在我的代码是这样的：
controller:
控制器：
[HttpPost]
[ValidateAntiForgeryToken]
public JsonResult CreateCompany(CompanyDataEntryViewModel modelData)
{...}
form:
形式：
@using (Html.BeginForm("", "", FormMethod.Post, new { id = "CreateCompanyDataEntryForm" }))
{
@Html.AntiForgeryToken()
...
}
Looking at generated HTML, AntiForgeryToken still generates a hidden field and provides an encrypted value. My action still works too. But I've lost the ability to designate a key to use in the encryption process. I'm not too sure how the process works, but before I can tell I was setting the salt value on the action and on the form. The values had to match in order for the action to accept the post. So, how do you set the salt value now? I think it has something to do with AntiForgeryConfig AdditionalDataProvider but I cannot find anything googling on how to use AntiForgeryConfig AdditionalDataProvider. Please help.
查看生成的 HTML，AntiForgeryToken 仍然生成隐藏字段并提供加密值。我的行动仍然有效。但是我已经失去了指定在加密过程中使用的密钥的能力。我不太确定这个过程是如何工作的，但在我告诉之前我是在操作和表单上设置盐值。这些值必须匹配才能使操作接受帖子。那么，你现在如何设置盐值？我认为它与 AntiForgeryConfig AdditionalDataProvider 有关，但我找不到任何关于如何使用 AntiForgeryConfig AdditionalDataProvider 的谷歌搜索。请帮忙。
Thanks
谢谢
回答by Levi
Setting the saltparameter is unnecessary and didn't provide any additional protection, so we removed support for it.
设置salt参数是不必要的，也没有提供任何额外的保护，所以我们取消了对它的支持。
Please see my response at How to choose a salt value for ValidateAntiForgeryTokenfor more information.
有关更多信息，请参阅我在如何为 ValidateAntiForgeryToken 选择盐值的回复。
