dotnet / dotnet/aspnetcore

Antiforgery validation failure returns 400 Bad Request for Controllers and 500 Internal Server Error for minimal APIs

Open
#58,441 0 comments 0 reactions 0 assignees View on GitHub
area-minimal
Dominant language
C#
Stars
38.4k
Forks
10.9k
Avg merge
2d 10h
Merged PRs (30d)
281

Description

### Is there an existing issue for this?

- [x] I have searched the existing issues

### Describe the bug

There's a difference in antiforgery prevention response between classic MVC and API controllers and minimal APIs.

* Controller: 400 Bad Request
* Minimal API: 500 Internal Server Error

### Expected Behavior

I expect the antiforgery validation failure response to be consistent between backend implementations so that I can write a frontend that is ignorant of the technology used in the backend.

### Steps To Reproduce

**Controller**

```csharp
[ApiController]
[Route("example-1")]
public class AntiforgeryExampleController : ControllerBase
{
[HttpPost]
[RequireAntiforgeryToken]
public IActionResult Post(IFormFile file)
{
return Ok();
}
}
```
```json
{
"type": "https://tools.ietf.org/html/rfc9110#section-15.5.1",
"title": "Bad Request",
"status": 400
}
```

**Minimal API**

```csharp
app.MapPost("example-2", (IFormFile file) => Results.Ok());
```
```json
{
"type": "https://tools.ietf.org/html/rfc9110#section-15.6.1",
"title": "An error occurred while processing your request.",
"status": 500
}
```

### Exceptions (if any)

_No response_

### .NET Version

8.0.403

### Anything else?

_No response_

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.