dotnet / dotnet/aspnetcore

`__RequestVerificationToken` Placement Issue with Multiple Handlers in Razor Pages

Open
#57,345 0 comments 0 reactions 0 assignees View on GitHub
area-mvc
Dominant language
C#
Stars
38.4k
Forks
10.9k
Avg merge
2d 6h
Merged PRs (30d)
290

Description

### Is there an existing issue for this?

- [X] I have searched the existing issues

### Describe the bug

When using multiple custom handlers in a Razor Pages application, the __RequestVerificationToken is inconsistently placed within the form. Specifically, when using one custom handler alongside the base handler (OnPostDelete + OnPost), the token is correctly included inside the form tags. However, when multiple custom handlers are used (OnPostDelete + OnConfirm + OnPost), the token is placed outside the form tags, leading to potential security issues.

1. OK
```


حفظ

حذف

```

2. Not Ok
```


حفظ

حذف


إعتماد

```

### Expected Behavior

The __RequestVerificationToken should be included inside the form tags regardless of the number of custom handlers present, ensuring consistent antiforgery protection.

### Steps To Reproduce

![image](https://github.com/user-attachments/assets/677a1180-c10d-4475-bce6-d07299456bbe)
![image](https://github.com/user-attachments/assets/21e630aa-ae10-47f5-b3e8-4f2b403d2699)

### Exceptions (if any)

_No response_

### .NET Version

8.0.4

### Anything else?

.NET SDK:
Version: 8.0.204
Commit: c338c7548c
Workload version: 8.0.200-manifests.7d36c14f

Runtime Environment:
OS Name: Windows
OS Version: 10.0.22631
OS Platform: Windows
RID: win-x64
Base Path: C:\Program Files\dotnet\sdk\8.0.204\

.NET workloads installed:
[maui-windows]
Installation Source: VS 17.9.34728.123
Manifest Version: 8.0.7/8.0.100
Manifest Path: C:\Program Files\dotnet\sdk-manifests\8.0.100\microsoft.net.sdk.maui\8.0.7\WorkloadManifest.json
Install Type: FileBased

[maccatalyst]
Installation Source: VS 17.9.34728.123
Manifest Version: 17.2.8004/8.0.100
Manifest Path: C:\Program Files\dotnet\sdk-manifests\8.0.100\microsoft.net.sdk.maccatalyst\17.2.8004\WorkloadManifest.json
Install Type: FileBased

[ios]
Installation Source: VS 17.9.34728.123
Manifest Version: 17.2.8004/8.0.100
Manifest Path: C:\Program Files\dotnet\sdk-manifests\8.0.100\microsoft.net.sdk.ios\17.2.8004\WorkloadManifest.json
Install Type: FileBased

[android]
Installation Source: VS 17.9.34728.123
Manifest Version: 34.0.52/8.0.100
Manifest Path: C:\Program Files\dotnet\sdk-manifests\8.0.100\microsoft.net.sdk.android\34.0.52\WorkloadManifest.json
Install Type: FileBased

Host:
Version: 8.0.4
Architecture: x64
Commit: 2d7eea2529

.NET SDKs installed:
7.0.408 [C:\Program Files\dotnet\sdk]
8.0.204 [C:\Program Files\dotnet\sdk]

.NET runtimes installed:
Microsoft.AspNetCore.App 3.1.32 [C:\Program Files\dotnet\shared\Microsoft.AspNetCore.App]
Microsoft.AspNetCore.App 6.0.29 [C:\Program Files\dotnet\shared\Microsoft.AspNetCore.App]
Microsoft.AspNetCore.App 7.0.18 [C:\Program Files\dotnet\shared\Microsoft.AspNetCore.App]
Microsoft.AspNetCore.App 8.0.4 [C:\Program Files\dotnet\shared\Microsoft.AspNetCore.App]
Microsoft.NETCore.App 3.1.32 [C:\Program Files\dotnet\shared\Microsoft.NETCore.App]
Microsoft.NETCore.App 6.0.29 [C:\Program Files\dotnet\shared\Microsoft.NETCore.App]
Microsoft.NETCore.App 7.0.18 [C:\Program Files\dotnet\shared\Microsoft.NETCore.App]
Microsoft.NETCore.App 8.0.4 [C:\Program Files\dotnet\shared\Microsoft.NETCore.App]
Microsoft.WindowsDesktop.App 3.1.32 [C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App]
Microsoft.WindowsDesktop.App 6.0.29 [C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App]
Microsoft.WindowsDesktop.App 7.0.18 [C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App]
Microsoft.WindowsDesktop.App 8.0.4 [C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App]

Other architectures found:
x86 [C:\Program Files (x86)\dotnet]
registered at [HKLM\SOFTWARE\dotnet\Setup\InstalledVersions\x86\InstallLocation]

Environment variables:
Not set

global.json file:
Not found

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.