文档

https://docs.abp.io/en/abp/latest/CSRF-Anti-Forgery

CSRF Anti Forgery 的token 什么时候写入COOKIE 的

调用 /api/abp/application-configuration时，



获取 token：

abp.security.antiForgery.getToken = function () {
return abp.utils.getCOOKIEValue(abp.security.antiForgery.tokenCOOKIEName);
};


其中，token名称为：

abp.security.antiForgery.tokenCOOKIEName = 'XSRF-TOKEN';
abp.security.antiForgery.tokenHeaderName = 'RequestVerificationToken';


为 ajax请求添加header:

ajaxSendHandler: function (event, request, settings) {
var token = abp.security.antiForgery.getToken();
if (!token) {
return;
}
if (!settings.headers || settings.headers[abp.security.antiForgery.tokenHeaderName] === undefined) {
request.setRequestHeader(abp.security.antiForgery.tokenHeaderName, token);
}
}


getCOOKIEValue(）

getCOOKIEValue 方法：

https://github.com/abpframework/abp/blob/48c52625f4c4df007f04d5ac6368b07411aa7521/framework/src/Volo.Abp.Swashbuckle/wwwroot/swagger/ui/abp.js

abp.utils.getCOOKIEValue = function (key) {
var equalities = document.COOKIE.split('; ');
for (var i = 0; i if (!equalities[i]) {
continue;
}
var splitted = equalities[i].split('=');
if (splitted.length != 2) {
continue;
}
if (decodeURIComponent(splitted[0]) === key) {
return decodeURIComponent(splitted[1] || '');
}
}
return null;
};