MVC4 AntiForgery令牌cookie名称附加随机字符串

Question

我遇到了MVC4的问题

@Html.AntiForgeryToken()

html助手.在我的开发机器上,当我运行项目时,在检查标题(使用Fiddler)时,返回的标记的名称是

__RequestVerificationToken

但是当部署到IIS 7.5版(Windows 2008 R2)时,令牌名称如下所示:

__RequestVerificationToken_L2V6b3JkZXI1

这在哪里变了？是因为我的应用程序没有部署到IIS的"根文件夹"？例如,我的应用程序已部署到

"http://myserver/myapp" instead of "http://myserver"

Answer 1

在查看源代码后我找到了答案:

http://aspnetwebstack.codeplex.com/SourceControl/latest#src/System.Web.WebPages/Helpers/AntiForgeryConfig.cs

是的,因为我的应用程序被部署到一个路径,下面的代码附加了路径的编码等效...希望这个发现将为您省去麻烦.

        // If the app path is provided, we're generating a cookie name rather than a field name, and the cookie names should
    // be unique so that a development server cookie and an IIS cookie - both running on localhost - don't stomp on
    // each other.
    internal static string GetAntiForgeryCookieName(string appPath)
    {
        if (String.IsNullOrEmpty(appPath) || appPath == "/")
        {
            return AntiForgeryTokenFieldName;
        }
        else
        {
            return AntiForgeryTokenFieldName + "_" + HttpServerUtility.UrlTokenEncode(Encoding.UTF8.GetBytes(appPath));
        }
    }