`__RequestVerificationToken` Placement Issue with Multiple Handlers in Razor Pages
- Dominant language
- C#
- Stars
- 38.4k
- Forks
- 10.9k
- Avg merge
- 2d 6h
- Merged PRs (30d)
- 290
Description
### Is there an existing issue for this?
- [X] I have searched the existing issues
### Describe the bug
When using multiple custom handlers in a Razor Pages application, the __RequestVerificationToken is inconsistently placed within the form. Specifically, when using one custom handler alongside the base handler (OnPostDelete + OnPost), the token is correctly included inside the form tags. However, when multiple custom handlers are used (OnPostDelete + OnConfirm + OnPost), the token is placed outside the form tags, leading to potential security issues.
1. OK
```
حفظ
حذف
```
2. Not Ok
```
حفظ
حذف
إعتماد
```
### Expected Behavior
The __RequestVerificationToken should be included inside the form tags regardless of the number of custom handlers present, ensuring consistent antiforgery protection.
### Steps To Reproduce


### Exceptions (if any)
_No response_
### .NET Version
8.0.4
### Anything else?
.NET SDK:
Version: 8.0.204
Commit: c338c7548c
Workload version: 8.0.200-manifests.7d36c14f
Runtime Environment:
OS Name: Windows
OS Version: 10.0.22631
OS Platform: Windows
RID: win-x64
Base Path: C:\Program Files\dotnet\sdk\8.0.204\
.NET workloads installed:
[maui-windows]
Installation Source: VS 17.9.34728.123
Manifest Version: 8.0.7/8.0.100
Manifest Path: C:\Program Files\dotnet\sdk-manifests\8.0.100\microsoft.net.sdk.maui\8.0.7\WorkloadManifest.json
Install Type: FileBased
[maccatalyst]
Installation Source: VS 17.9.34728.123
Manifest Version: 17.2.8004/8.0.100
Manifest Path: C:\Program Files\dotnet\sdk-manifests\8.0.100\microsoft.net.sdk.maccatalyst\17.2.8004\WorkloadManifest.json
Install Type: FileBased
[ios]
Installation Source: VS 17.9.34728.123
Manifest Version: 17.2.8004/8.0.100
Manifest Path: C:\Program Files\dotnet\sdk-manifests\8.0.100\microsoft.net.sdk.ios\17.2.8004\WorkloadManifest.json
Install Type: FileBased
[android]
Installation Source: VS 17.9.34728.123
Manifest Version: 34.0.52/8.0.100
Manifest Path: C:\Program Files\dotnet\sdk-manifests\8.0.100\microsoft.net.sdk.android\34.0.52\WorkloadManifest.json
Install Type: FileBased
Host:
Version: 8.0.4
Architecture: x64
Commit: 2d7eea2529
.NET SDKs installed:
7.0.408 [C:\Program Files\dotnet\sdk]
8.0.204 [C:\Program Files\dotnet\sdk]
.NET runtimes installed:
Microsoft.AspNetCore.App 3.1.32 [C:\Program Files\dotnet\shared\Microsoft.AspNetCore.App]
Microsoft.AspNetCore.App 6.0.29 [C:\Program Files\dotnet\shared\Microsoft.AspNetCore.App]
Microsoft.AspNetCore.App 7.0.18 [C:\Program Files\dotnet\shared\Microsoft.AspNetCore.App]
Microsoft.AspNetCore.App 8.0.4 [C:\Program Files\dotnet\shared\Microsoft.AspNetCore.App]
Microsoft.NETCore.App 3.1.32 [C:\Program Files\dotnet\shared\Microsoft.NETCore.App]
Microsoft.NETCore.App 6.0.29 [C:\Program Files\dotnet\shared\Microsoft.NETCore.App]
Microsoft.NETCore.App 7.0.18 [C:\Program Files\dotnet\shared\Microsoft.NETCore.App]
Microsoft.NETCore.App 8.0.4 [C:\Program Files\dotnet\shared\Microsoft.NETCore.App]
Microsoft.WindowsDesktop.App 3.1.32 [C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App]
Microsoft.WindowsDesktop.App 6.0.29 [C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App]
Microsoft.WindowsDesktop.App 7.0.18 [C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App]
Microsoft.WindowsDesktop.App 8.0.4 [C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App]
Other architectures found:
x86 [C:\Program Files (x86)\dotnet]
registered at [HKLM\SOFTWARE\dotnet\Setup\InstalledVersions\x86\InstallLocation]
Environment variables:
Not set
global.json file:
Not found
Contributor guide
Assessment
This issue has not been assessed yet.